Loading story…
Microsoft is rolling out a new Teams security capability that lets end users report suspicious or unwanted one-to-one voice calls as potential scams or phishing attempts. The feature adds a “Report a Call” option in call history (via the More options menu) on Windows, macOS, and web, addressing a visibility gap where organizations previously had limited user-driven reporting for voice-based social engineering attempts.
When a call is reported, Microsoft says only limited call metadata is shared with the organization and Microsoft—such as timestamps, call duration, caller ID (if available), and participant Teams IDs—without indicating that call audio is collected. Reports can be reviewed in the Teams Admin Center and, for organizations with Defender for Office 365 (Plan 1/Plan 2) or Microsoft Defender XDR, in the Microsoft Defender portal; the feature is enabled by default but can be disabled by admins in Teams calling settings. Microsoft indicated a phased rollout beginning with targeted release in mid-March and broader availability thereafter.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft said the Teams 'Report a Call' feature is expected to reach worldwide general availability in mid-to-late April 2026. Organizations with Defender for Office 365 or Defender XDR will be able to review reports in the Microsoft Defender portal, while others will see basic data in the Teams Admin Center.
Microsoft said the new Teams call-reporting feature is scheduled to start rolling out to Targeted Release customers in mid-March 2026, with completion expected later that month. The feature will be available in call history on Teams for Windows, Mac, and the web.
Microsoft announced it will add a new 'Report a Call' capability to Microsoft Teams so users can flag suspicious, scam, phishing, or unwanted one-to-one calls. The feature is enabled by default and shares limited call metadata with organizations and Microsoft for investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is rolling out a **"Report a concern"** feature in Microsoft Teams that lets meeting participants flag suspected phishing, impersonation, scams, social engineering, and other suspicious behavior tied to meetings or meeting chat. Reports will be surfaced to defenders through the **Teams admin center** and **Microsoft Defender portal**, where security teams can review meeting metadata and limited contextual information as they investigate possible abuse. Microsoft is also adding controls to detect external meeting bots and improve organizer visibility into unauthorized AI assistants joining meetings, with the feature enabled by default as part of a broader push to harden collaboration platforms against fraud. The move follows Microsoft's warning that **AI-powered deception** is accelerating fraud operations, including deepfake participants, voice cloning, and other impersonation tactics that exploit trust in digital communications. Separate user reporting has also highlighted how Microsoft security workflows can create confusion for administrators and employees, particularly when phishing-reporting actions in Outlook appear in security tooling as user interaction with a malicious message. Together, the updates show Microsoft expanding in-product reporting and investigation capabilities while organizations contend with increasingly convincing AI-enabled scams across email and meetings.
Aug 4, 2026
Microsoft is rolling out **Brand Impersonation Protection** for *Microsoft Teams Calling* to warn users about potentially fraudulent external VoIP callers attempting to impersonate trusted organizations. The feature evaluates **first-contact external calls** for impersonation risk signals and, when a call is deemed high-risk, displays warnings before the user answers; warnings can also persist during the call if suspicious indicators remain. Users can then choose to **accept, block, or end** the call to reduce exposure to social engineering and **vishing** attempts. Deployment is expected to begin in the **Targeted Release** ring in **mid-February 2026** and will be **enabled by default** for Teams Calling tenants, with broader availability timing to be communicated later. Microsoft indicates no administrative changes are required to enable the capability, but recommends preparing helpdesk/support teams for user questions and updating internal awareness/training materials to reflect the new high-risk call alerts; support is noted for **Windows desktop and macOS** clients.
Jun 29, 2026
Microsoft is introducing a new security feature for its Teams collaboration platform called the "External Domains Anomalies Report," aimed at enhancing the detection of suspicious or risky interactions with external organizations. This tool, scheduled for rollout in February 2026, will provide IT administrators with behavioral analytics to identify unusual communication patterns, such as sudden spikes in message volume to specific external domains or interactions with previously unseen domains. The feature is designed to address the growing security challenges posed by increased external collaboration and remote work, offering actionable intelligence to help prevent data leaks, social engineering attacks, and unauthorized use of third-party services. The report will be available for standard multi-tenant cloud environments via the Teams web platform and will help organizations maintain a balance between productive cross-organization work and robust data protection. In addition to this new reporting capability, Microsoft continues to enhance Teams' security posture by warning users about malicious links, improving protections against unsafe file types, and introducing features to block unauthorized screen captures and streamline client performance. The External Domains Anomalies Report represents a proactive step in giving administrators early visibility into potential threats arising from external communications.
Jun 29, 2026