Loading story…
Microsoft is rolling out Brand Impersonation Protection for Microsoft Teams Calling to warn users about potentially fraudulent external VoIP callers attempting to impersonate trusted organizations. The feature evaluates first-contact external calls for impersonation risk signals and, when a call is deemed high-risk, displays warnings before the user answers; warnings can also persist during the call if suspicious indicators remain. Users can then choose to accept, block, or end the call to reduce exposure to social engineering and vishing attempts.
Deployment is expected to begin in the Targeted Release ring in mid-February 2026 and will be enabled by default for Teams Calling tenants, with broader availability timing to be communicated later. Microsoft indicates no administrative changes are required to enable the capability, but recommends preparing helpdesk/support teams for user questions and updating internal awareness/training materials to reflect the new high-risk call alerts; support is noted for Windows desktop and macOS clients.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft said deployment of Brand Impersonation Protection for Targeted Release customers is expected to finish by late February 2026. General availability timing had not yet been announced.
Microsoft said Brand Impersonation Protection would begin rolling out to Teams Targeted Release customers in mid-February 2026. The feature will be enabled by default and require no administrator action or policy changes.
Microsoft announced a new Teams calling security feature, Brand Impersonation Protection, designed to warn users about potentially fraudulent first-time external VoIP callers impersonating trusted organizations. The feature presents high-risk warnings before answering and can keep alerts visible during calls if suspicious indicators persist.
In January 2026, Microsoft turned on several Teams messaging security protections by default, including malicious URL detection, protection against weaponizable file types, and false-positive reporting. These changes were described as part of Microsoft's broader Teams security hardening efforts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is rolling out a new **Teams** security capability that lets end users report suspicious or unwanted **one-to-one voice calls** as potential scams or phishing attempts. The feature adds a **“Report a Call”** option in call history (via the `More options` menu) on **Windows, macOS, and web**, addressing a visibility gap where organizations previously had limited user-driven reporting for voice-based social engineering attempts. When a call is reported, Microsoft says only **limited call metadata** is shared with the organization and Microsoft—such as timestamps, call duration, caller ID (if available), and participant Teams IDs—without indicating that call audio is collected. Reports can be reviewed in the **Teams Admin Center** and, for organizations with **Defender for Office 365 (Plan 1/Plan 2)** or **Microsoft Defender XDR**, in the **Microsoft Defender portal**; the feature is **enabled by default** but can be disabled by admins in Teams calling settings. Microsoft indicated a phased rollout beginning with targeted release in mid-March and broader availability thereafter.
Jun 29, 2026
Researchers at Check Point disclosed four critical vulnerabilities in Microsoft Teams that allowed attackers to impersonate executives, alter chat history, and forge notifications or caller identities without detection. These flaws, now patched, enabled manipulation of message content without the usual 'Edited' label, spoofing of alerts to appear from trusted colleagues, and renaming of chats to misrepresent participants. The vulnerabilities exploited Teams' messaging architecture, including the reuse of unique message identifiers and manipulation of hidden conversation parameters, fundamentally undermining the trust in digital communications for over 320 million monthly users. Microsoft was notified of the issues in March 2024 and addressed them through a series of patches, with the final fix released in October 2025. The vulnerabilities, tracked as CVE-2024-38197 among others, affected both internal users and external guests, posing significant risks of social engineering, data theft, and unauthorized actions. Attackers could trick users into clicking malicious links or sharing sensitive information by making messages and calls appear to originate from high-profile executives or trusted sources, highlighting the importance of prompt patching and ongoing vigilance in collaboration platforms.
Jun 29, 2026
Microsoft is rolling out a **"Report a concern"** feature in Microsoft Teams that lets meeting participants flag suspected phishing, impersonation, scams, social engineering, and other suspicious behavior tied to meetings or meeting chat. Reports will be surfaced to defenders through the **Teams admin center** and **Microsoft Defender portal**, where security teams can review meeting metadata and limited contextual information as they investigate possible abuse. Microsoft is also adding controls to detect external meeting bots and improve organizer visibility into unauthorized AI assistants joining meetings, with the feature enabled by default as part of a broader push to harden collaboration platforms against fraud. The move follows Microsoft's warning that **AI-powered deception** is accelerating fraud operations, including deepfake participants, voice cloning, and other impersonation tactics that exploit trust in digital communications. Separate user reporting has also highlighted how Microsoft security workflows can create confusion for administrators and employees, particularly when phishing-reporting actions in Outlook appear in security tooling as user interaction with a malicious message. Together, the updates show Microsoft expanding in-product reporting and investigation capabilities while organizations contend with increasingly convincing AI-enabled scams across email and meetings.
Aug 4, 2026