Microsoft Teams Adds New Security Feature to Detect Malicious QR Codes in Messages

Microsoft is enhancing Teams security with a new feature that detects malicious URLs hidden in QR codes and alerts recipients after they receive messages.

This improvement extends the protections offered by Microsoft Defender for Office 365, combining message alerts with additional investigative information for security teams.

Teams Detect Malicious QR Codes

According to Message Center notice MC1490905, published on October 7, the global rollout will begin in early October 2026 and is expected to be completed by early November. Organizations using Teams with Defender for Office 365 will receive this enhancement automatically, with no separate setup required.

The new protection feature examines QR codes in received Teams messages, extracts the web addresses they contain, and checks whether those destinations are harmful. If a dangerous URL is detected, Teams will display a warning on the relevant message in both internal and external conversations.

Microsoft has provided examples of messages labeled as potentially harmful and channel posts marked as blocked. These indicate different enforcement outcomes, but they do not guarantee that every suspicious QR code will be automatically removed.

Organizations with Defender for Office 365 Plan 1 or Plan 2 can also utilize Zero-hour Auto Purge (ZAP) for eligible internal messages. According to Microsoft, ZAP quarantines internal chats or channel messages identified as malware or high-confidence phishing after delivery.

Detection, warning, and quarantine are distinct actions. Whether a message is eligible for blocking depends on its threat classification and the applicable protection settings.

QR code phishing, often called quishing, embeds a malicious destination in an image instead of a traditional clickable link. Attackers may frame scanning requests as account verification, document access, or urgent technical support, redirecting recipients to fraudulent authentication sites.

By extracting the encoded address, Defender can evaluate the destination itself rather than solely depending on the surrounding text.

This enhancement is different from the previously announced protection for external senders, which obscures QR code images until recipients choose to reveal them, adding an extra step before scanning. In contrast, the new feature assesses extracted URLs after a message is delivered and responds to any identified threats. Together, these controls address different stages of exposure.

The announcement also mentions new visibility in Microsoft Defender XDR Advanced Hunting. Extracted addresses will be recorded in the MessageUrlInfo table, with QR codes noted in the UrlLocation column, helping analysts identify QR-embedded links during investigations.

Microsoft’s documentation outlines Teams URL hunting tables and provides controls for reviewing ZAP status, quarantine policies, and recipient exclusions. Administrators should review these settings and integrate QR detections into their investigation workflows.

Because this protection occurs post-delivery, employees may see a message before any remediation occurs. Always verify unusual scanning requests, especially those asking for credentials or urgent account repairs, through trusted channels.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.