Loading story…
Microsoft is extending Defender for Office 365 protection for Microsoft Teams to detect malicious URLs hidden in QR codes after messages have been delivered. The worldwide rollout is scheduled to begin in early October 2026 and finish by early November, with no separate end-user setup required. Teams will display warnings when malicious destinations are identified, and eligible internal messages may also be blocked through Zero-hour Auto Purge (ZAP).
Security teams will be able to investigate URLs extracted from QR codes through the MessageUrlInfo table in Microsoft Defender XDR, providing visibility into QR-based phishing attempts delivered through Teams. The enhancement adds post-delivery protection rather than guaranteeing that harmful QR codes are blocked before users encounter them. Organizations should account for that exposure window and incorporate the extracted URLs into phishing investigations rather than treating the feature as preventive blocking.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft published Message Center notice MC1490905 announcing that Defender for Office 365 will inspect URLs embedded in Teams QR codes after message delivery and display warnings for malicious destinations. Eligible internal messages may also be blocked through Zero-hour Auto Purge, and extracted URLs will be available in Defender XDR's MessageUrlInfo table for investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is developing a Microsoft Teams safeguard that will obscure images containing QR codes in messages from external users by default. Recipients will have to deliberately reveal an image before they can view or scan its QR code, reducing the chance that a malicious destination is opened through an unsolicited message. Microsoft expects the protection to begin rolling out in October 2026 for Teams on Android, iOS, Windows and Mac. The change addresses QR-code phishing, in which attackers use codes to conceal fraudulent or malicious links from users until after a scan. QR codes are also used in consumer scams, including deceptive codes delivered on unexpected packages, making deliberate verification of a code’s source and destination an important defense against fraud and credential theft.
Sep 4, 2026Microsoft said attackers are increasingly using **QR-code phishing** to steal credentials, with the company analyzing **8.3 billion** email-based phishing threats in Q1 2026 and recording a **146% increase** in quishing activity. Researchers said more than **35,000 users** across roughly **13,000 organizations** were targeted through emails, PDFs, and fake CAPTCHA pages carrying malicious QR codes that redirected victims through multiple sites to counterfeit login portals. Microsoft also reported a **336% surge** in QR codes embedded directly in emails in March, alongside continued business email compromise lures and phishing kits such as **Tycoon2FA**, which it disrupted with Europol before operators began rebuilding infrastructure and shifting toward `.RU` domains. The warning follows a separate Microsoft 365 security incident in which faulty heuristic anti-phishing rules in Exchange Online and Teams wrongly flagged legitimate content as malicious. The incident, tracked as **`EX1227432`**, caused valid emails to be quarantined, links to be blocked, **Zero-hour Auto Purge (ZAP)** actions to trigger incorrectly, and false **Microsoft XDR** alerts to be sent after a logic error misclassified legitimate URLs as phishing links. Microsoft said the outage was prolonged by bugs in related signature and rollback systems, underscoring how both attacker evasion and defensive misfires can disrupt cloud email security and credential protection efforts.
Jun 29, 2026
Microsoft is expanding end-user reporting capabilities in **Microsoft Teams** by enabling **Defender for Office 365 Plan 1** customers to report suspicious messages directly in Teams (Roadmap ID `531760`), a capability previously limited to Plan 2. The feature is intended to strengthen collaboration-platform defenses by letting users classify messages as **Security Risk** (suspected phishing/malware/spam) or **Not a Security Risk** (false positives), providing additional signals to SOC workflows and improving detection for chat-based social engineering such as **BEC-style** lures delivered via Teams; the rollout is expected to complete by late March 2026 and requires administrative enablement. Separately, Microsoft acknowledged an **Exchange Online** service issue in which legitimate emails were incorrectly marked as phishing/spam and quarantined, disrupting some users’ ability to send/receive email. Microsoft attributed the false positives to a **new URL rule** that misclassified certain legitimate URLs/domains as malicious due to evolving detection criteria; some previously quarantined messages may begin reappearing as mitigations roll out, but other emails may remain quarantined until the fix is fully deployed, and affected organizations are advised to review quarantine for missing legitimate mail.
Jun 29, 2026