Microsoft Warns of Surging QR-Code Phishing After Exchange Anti-Phishing Failure

Microsoft said attackers are increasingly using QR-code phishing to steal credentials, with the company analyzing 8.3 billion email-based phishing threats in Q1 2026 and recording a 146% increase in quishing activity. Researchers said more than 35,000 users across roughly 13,000 organizations were targeted through emails, PDFs, and fake CAPTCHA pages carrying malicious QR codes that redirected victims through multiple sites to counterfeit login portals. Microsoft also reported a 336% surge in QR codes embedded directly in emails in March, alongside continued business email compromise lures and phishing kits such as Tycoon2FA, which it disrupted with Europol before operators began rebuilding infrastructure and shifting toward .RU domains.

The warning follows a separate Microsoft 365 security incident in which faulty heuristic anti-phishing rules in Exchange Online and Teams wrongly flagged legitimate content as malicious. The incident, tracked as EX1227432, caused valid emails to be quarantined, links to be blocked, Zero-hour Auto Purge (ZAP) actions to trigger incorrectly, and false Microsoft XDR alerts to be sent after a logic error misclassified legitimate URLs as phishing links. Microsoft said the outage was prolonged by bugs in related signature and rollback systems, underscoring how both attacker evasion and defensive misfires can disrupt cloud email security and credential protection efforts.