Microsoft is developing a new security feature for Teams messaging that will obscure QR codes sent by external users. This measure aims to help organizations reduce phishing and fraud risks associated with malicious QR code campaigns.
Listed under Microsoft 365 Roadmap ID 570439, this feature is currently in development and is scheduled for rollout in October 2026. It will be available on Microsoft Teams across Android, iOS, desktop, and Mac platforms for worldwide standard multi-tenant cloud environments.
Microsoft Teams QR Code Protection
The upcoming protection targets QR codes embedded in images shared through Teams messages by external senders. Instead of displaying the QR code immediately, Teams will by default obscure the image content.
Users who want to inspect the image will need to take intentional action to reveal the QR code before viewing or scanning it. This additional step is designed to interrupt impulsive behavior, especially when an attacker uses urgency, impersonation, or social-engineering tactics to pressure a target into scanning a code.
QR code phishing, often referred to as “quishing,” has become an increasingly effective social-engineering technique because it allows malicious destinations to be concealed within a simple image.
Attackers can embed links to credential-harvesting pages, malware delivery sites, fake authentication portals, or fraudulent payment pages inside QR codes. Unlike standard URLs, QR codes can be harder for users to evaluate before interacting with them.
A victim may scan the image using a personal mobile device, bypassing corporate browser controls, endpoint protections, and email security filters.
The new behavior in Teams introduces a friction point before users can scan a QR code from an external contact. While it does not eliminate the underlying threat, this protection encourages users to verify the sender, assess the message context, and avoid scanning unexpected codes.
This change may help security teams reduce the success rate of QR-based phishing delivered through collaboration platforms. It complements existing Teams security features, including external access policies, guest controls, message monitoring, identity protections, and user awareness training. Â
Organizations should review their Teams external communication settings before the rollout and ensure that employees understand the risks associated with QR codes received in unsolicited messages.
Security teams should advise users to treat QR codes from unknown or unexpected external contacts as potentially malicious. Before revealing or scanning a code, employees should independently verify the sender through a trusted communication channel and avoid entering corporate credentials after following links generated by QR codes.
Microsoft has marked this feature for both Targeted Release and General Availability. The roadmap entry was added and last modified on September 3, 2026, with deployment expected to begin in October.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
