Loading story…
Microsoft is rolling out a "Report a concern" feature in Microsoft Teams that lets meeting participants flag suspected phishing, impersonation, scams, social engineering, and other suspicious behavior tied to meetings or meeting chat. Reports will be surfaced to defenders through the Teams admin center and Microsoft Defender portal, where security teams can review meeting metadata and limited contextual information as they investigate possible abuse. Microsoft is also adding controls to detect external meeting bots and improve organizer visibility into unauthorized AI assistants joining meetings, with the feature enabled by default as part of a broader push to harden collaboration platforms against fraud.
The move follows Microsoft's warning that AI-powered deception is accelerating fraud operations, including deepfake participants, voice cloning, and other impersonation tactics that exploit trust in digital communications. Separate user reporting has also highlighted how Microsoft security workflows can create confusion for administrators and employees, particularly when phishing-reporting actions in Outlook appear in security tooling as user interaction with a malicious message. Together, the updates show Microsoft expanding in-product reporting and investigation capabilities while organizations contend with increasingly convincing AI-enabled scams across email and meetings.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
A Reddit discussion described how reporting emails as phishing in Microsoft Outlook can generate alerts in Microsoft Defender that show the email details and the reporting mailbox. Commenters also claimed the built-in Microsoft report button can appear as a "click" during phishing testing, causing confusion for administrators and users.
Microsoft confirmed it is rolling out a new Teams feature called "Report a concern" that lets participants flag phishing, impersonation, scams, social engineering, and other suspicious behavior during meetings or from meeting chat. Reports are made available to organizations through the Teams admin center and, for customers with Defender, the Microsoft Defender portal.
Microsoft published Cyber Signals Issue 9 describing AI-powered deception and fraud trends, including attackers using AI to scrape company information, create deepfake participants, and clone voices. The report said AI-powered fraud attacks were occurring globally and highlighted activity from China and Europe, with rising threats in Germany.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
windowslatest.com
Open sourcereddit.com
Open sourcemicrosoft.com
Open sourceadmin.cloud.microsoft
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has introduced new protections in **Teams** to stop unwanted third-party bots from automatically joining meetings, after warning that some service bots continued entering future meetings without users intending them to. The company said the behavior creates security and privacy risks for sensitive discussions, and its new system uses behavioral and infrastructure signals to better distinguish bots from human participants. Suspected bots are now routed to the lobby for explicit organizer approval, and organizers can see them more clearly before admitting them. Microsoft also added a Teams admin policy that allows organizations to require approval before third-party bots can join meetings, even when regular attendees are allowed to bypass the lobby. The policy can be assigned to specific users or groups through the Teams Admin Center, while Microsoft develops a registration path for independent software vendors so approved bots can self-identify as known participants. The rollout is underway, with Microsoft planning to retire earlier CAPTCHA-based defenses and later add approved-bot allow lists, full blocking of external bots, audit logs, and reporting as part of a broader effort to harden Teams against social-engineering and impersonation abuse.
Jul 2, 2026
Microsoft is rolling out a new **Teams** security capability that lets end users report suspicious or unwanted **one-to-one voice calls** as potential scams or phishing attempts. The feature adds a **“Report a Call”** option in call history (via the `More options` menu) on **Windows, macOS, and web**, addressing a visibility gap where organizations previously had limited user-driven reporting for voice-based social engineering attempts. When a call is reported, Microsoft says only **limited call metadata** is shared with the organization and Microsoft—such as timestamps, call duration, caller ID (if available), and participant Teams IDs—without indicating that call audio is collected. Reports can be reviewed in the **Teams Admin Center** and, for organizations with **Defender for Office 365 (Plan 1/Plan 2)** or **Microsoft Defender XDR**, in the **Microsoft Defender portal**; the feature is **enabled by default** but can be disabled by admins in Teams calling settings. Microsoft indicated a phased rollout beginning with targeted release in mid-March and broader availability thereafter.
Jun 29, 2026
Microsoft has introduced a new **Teams meeting protection policy** that allows administrators to automatically block identified external bots from joining meetings, adding a stronger safeguard against unwanted third-party access. The feature builds on an earlier control that flagged suspected bots in the lobby and required organizer approval, and it is being rolled out in targeted release before broader availability. Microsoft said the setting will be **off by default** in the Teams admin center. The new control is designed to reduce the risk that legitimate third-party bots or malicious applications could be used to monitor meetings, harvest sensitive information, or support social engineering and follow-on intrusion activity. Administrative options tied to the policy include `ExternalBotAccessMode` settings such as `BlockDetectedBots`, `RequireApprovalWhenDetected`, and `AllowAllBots`, reflecting Microsoft’s broader effort to curb abuse of Teams by attackers posing as IT or helpdesk staff to gain remote access and steal data.
Aug 25, 2026