Microsoft Teams to Warn Users of Malicious QR Code Links

Key Takeaways

• Microsoft Teams is integrating enhanced security features to detect and warn users about malicious QR code links within messages.
• This new capability, part of Microsoft Defender for Office 365, analyzes URLs embedded in QR codes post-delivery.
• Rollout is scheduled globally from early October to early November 2026 for organizations utilizing Teams with Defender for Office 365.
• The protection aims to combat “quishing” attacks by identifying and flagging harmful web addresses.

Microsoft Teams Boosts QR Code Security Against Malicious Links

Microsoft is rolling out a significant security enhancement for Teams, designed to identify and alert users to malicious links concealed within QR codes. This update integrates QR code scanning into the existing Microsoft Defender for Office 365 framework, offering clearer user warnings and providing security teams with crucial data for investigating suspicious communications.

According to a Message Center notice MC1490905, released on October 7, the global deployment of this feature is slated to commence in early October 2026, with completion anticipated by early November of the same year. The new functionality will automatically apply to organizations using Microsoft Teams in conjunction with Defender for Office 365 and requires no manual setup by end users.

How the New Protection Works

The updated security mechanism operates by inspecting Teams messages that contain QR codes after they have been delivered. Defender extracts the Uniform Resource Locators (URLs) embedded within these codes and scrutinizes them for malicious content. Should a dangerous URL be detected, Teams will display a prominent warning on the affected message, applicable to both internal and external conversations.

Microsoft’s illustrative screenshots demonstrate various warning scenarios, including messages explicitly stating that a contained link might be harmful, and channel posts marked as blocked due to potentially dangerous content. These examples highlight the dual outcomes of the system: either a visible warning to the user or the outright blocking of the message, indicating that not every suspicious code will necessarily be removed, but rather appropriately flagged or mitigated.

Organizations subscribed to Defender for Office 365 Plan 1 or Plan 2, with Zero-hour Auto Purge (ZAP) enabled for Teams, may also see eligible malicious internal messages automatically blocked. ZAP is an existing feature designed to act on harmful messages post-delivery. Administrators can review its configuration and exclusions through Microsoft’s Teams protection documentation.

Combating “Quishing” Attacks

QR code phishing, commonly referred to as “quishing,” involves embedding a malicious web address within an image, bypassing traditional text-based link analysis. Attackers frequently employ social engineering tactics, such as requests to verify accounts, review urgent documents, or resolve technical issues, to entice victims into scanning these codes. Upon scanning, users may be redirected to deceptive sign-in pages designed to steal their credentials.

This new capability directly addresses the growing threat of quishing. By extracting and checking the address contained within the QR image, defenders can assess the true destination of the link, rather than relying solely on the context of the surrounding message, which can be easily faked.

It is important to distinguish this update from a previously reported Teams QR code protection for external senders, which primarily obscured QR images until users opted to reveal them. The new Defender capability actively evaluates extracted URLs post-delivery and responds specifically when malicious content is identified. These two controls address distinct stages of user exposure to QR code threats.

Enhanced Visibility for Security Teams

Security teams will also gain enhanced visibility into these threats through Advanced Hunting within Microsoft Defender XDR. URLs extracted from QR codes will be logged in the MessageUrlInfo table, with the UrlLocation column specifically recording QRCode. This allows analysts to efficiently identify URLs found inside QR images during their investigations.

Microsoft advises organizations to review their existing Teams protection settings and ZAP configurations, inform security operations staff about the new hunting data available, and update investigation processes to incorporate QR code detections. No specific action is required to enable this enhancement, as it integrates seamlessly with existing Teams URL protection.

The “post-delivery” nature of this protection is a crucial detail; it serves as a robust defense mechanism but does not guarantee that every harmful QR code will be blocked before a user sees it. Therefore, employees must continue to exercise caution, verifying unexpected scanning requests through trusted channels, particularly when messages prompt them to sign in or address urgent work-related account issues.

What You Should Do

• Inform your security operations center (SOC) staff about the new data available in Microsoft Defender XDR for QR code-related incidents.
• Review and, if necessary, update your organization’s existing Teams protection settings, especially Zero-hour Auto Purge (ZAP) configurations.
• Educate end-users on the risks of “quishing” and reinforce the importance of verifying unexpected QR code scanning requests through trusted channels.
• Advise users to be particularly vigilant when messages ask them to sign in or resolve urgent account issues via QR code scans.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.