Loading story…
Microsoft plans to integrate certified third-party deepfake detection into Teams meetings, with rollout scheduled to begin in November 2026 and worldwide general availability targeted for that month. Providers will analyze meeting audio and video for synthetic or manipulated media and return detection signals that Teams will surface through in-meeting experiences and controls; Teams will not perform the detection itself. A separate built-in impersonation-protection feature will warn users about potentially suspicious meeting organizers and participants, extending protections against social engineering, malicious external participation, and phishing.
The capabilities address identity-deception risks illustrated by deepfake phishing calls targeting cryptocurrency users, but Microsoft has not identified supported providers or disclosed detection accuracy, meeting-data handling practices, additional licensing requirements, administrator activation procedures, or specific release dates. The roadmap also does not establish universal meeting scanning. Organizations should treat detection signals as an additional safeguard—not proof of identity—and retain independent verification for requests to install software, disclose credentials, or approve payments.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A separate Microsoft roadmap entry describes built-in warnings and risk indicators for potentially suspicious meeting organizers and participants. Microsoft targets worldwide general availability in November 2026; this capability addresses identity deception rather than manipulated audio or video.
Microsoft 365 roadmap entry 573451 describes planned integration with certified third-party providers that analyze meeting audio and video and return detection signals for Teams to surface. Microsoft targets rollout beginning in November 2026, but the sources do not date the roadmap disclosure or identify providers, licensing costs, or meeting-data handling practices.
A reported phishing campaign invited cryptocurrency users through Telegram to Zoom or Teams calls featuring AI-generated versions of familiar contacts. Attackers claimed an audio problem required a plugin or update, tricking victims into installing malware capable of stealing wallets, credentials, and Telegram accounts.
A Teams meeting protection policy began rolling out in August to automatically block identified external bots from joining meetings. The source does not specify the year.
Microsoft announced in December that administrators would be able to block external users through the Defender portal, with availability beginning in January. The source does not specify the year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceghacks.net
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is rolling out a **"Report a concern"** feature in Microsoft Teams that lets meeting participants flag suspected phishing, impersonation, scams, social engineering, and other suspicious behavior tied to meetings or meeting chat. Reports will be surfaced to defenders through the **Teams admin center** and **Microsoft Defender portal**, where security teams can review meeting metadata and limited contextual information as they investigate possible abuse. Microsoft is also adding controls to detect external meeting bots and improve organizer visibility into unauthorized AI assistants joining meetings, with the feature enabled by default as part of a broader push to harden collaboration platforms against fraud. The move follows Microsoft's warning that **AI-powered deception** is accelerating fraud operations, including deepfake participants, voice cloning, and other impersonation tactics that exploit trust in digital communications. Separate user reporting has also highlighted how Microsoft security workflows can create confusion for administrators and employees, particularly when phishing-reporting actions in Outlook appear in security tooling as user interaction with a malicious message. Together, the updates show Microsoft expanding in-product reporting and investigation capabilities while organizations contend with increasingly convincing AI-enabled scams across email and meetings.
Aug 4, 2026
Microsoft is rolling out **Brand Impersonation Protection** for *Microsoft Teams Calling* to warn users about potentially fraudulent external VoIP callers attempting to impersonate trusted organizations. The feature evaluates **first-contact external calls** for impersonation risk signals and, when a call is deemed high-risk, displays warnings before the user answers; warnings can also persist during the call if suspicious indicators remain. Users can then choose to **accept, block, or end** the call to reduce exposure to social engineering and **vishing** attempts. Deployment is expected to begin in the **Targeted Release** ring in **mid-February 2026** and will be **enabled by default** for Teams Calling tenants, with broader availability timing to be communicated later. Microsoft indicates no administrative changes are required to enable the capability, but recommends preparing helpdesk/support teams for user questions and updating internal awareness/training materials to reflect the new high-risk call alerts; support is noted for **Windows desktop and macOS** clients.
Jun 29, 2026
Microsoft has introduced new protections in **Teams** to stop unwanted third-party bots from automatically joining meetings, after warning that some service bots continued entering future meetings without users intending them to. The company said the behavior creates security and privacy risks for sensitive discussions, and its new system uses behavioral and infrastructure signals to better distinguish bots from human participants. Suspected bots are now routed to the lobby for explicit organizer approval, and organizers can see them more clearly before admitting them. Microsoft also added a Teams admin policy that allows organizations to require approval before third-party bots can join meetings, even when regular attendees are allowed to bypass the lobby. The policy can be assigned to specific users or groups through the Teams Admin Center, while Microsoft develops a registration path for independent software vendors so approved bots can self-identify as known participants. The rollout is underway, with Microsoft planning to retire earlier CAPTCHA-based defenses and later add approved-bot allow lists, full blocking of external bots, audit logs, and reporting as part of a broader effort to harden Teams against social-engineering and impersonation abuse.
Jul 2, 2026