Published on October 11, 2026
Microsoft Teams to Warn Users About Malicious Links Hidden in QR Codes
Severity
Medium
Detail
Microsoft is expanding its security capabilities within Microsoft Teams to combat QR code phishing (“quishing”) by integrating automated QR code URL extraction into Microsoft Defender for Office 365. Announced via Message Center notice MC1490905 and rolling out globally between October and November 2026, this enhancement automatically inspects images containing QR codes shared in internal and external Teams chats or channel posts.
By extracting and evaluating the destination URLs embedded within these images after delivery, Defender provides prominent user warnings or blocks dangerous messages outright, equipping security teams with new telemetry to investigate modern social-engineering attacks.
How?
The protection mechanism operates post-delivery as part of Microsoft Defender for Office 365’s existing URL-checking infrastructure. When a user receives a Teams message containing an image with a QR code, Defender’s backend processing extracts the hidden web addresses encoded within the visual matrix.
Once extracted, the URL is scanned against threat intelligence feeds to determine if it points to known malicious infrastructure, such as credential-harvesting pages designed to mimic corporate login portals. Depending on the threat assessment and organizational configuration:
- User Warnings: If a potentially harmful URL is identified, Teams displays a visible warning banner directly on the affected message in both internal and external conversations.
- Automated Remediation (ZAP): For organizations running Defender for Office 365 Plan 1 or Plan 2 with Zero-hour Auto Purge (ZAP) enabled for Teams, malicious messages containing harmful QR codes can be automatically blocked or purged after delivery.
- Threat Intelligence & Hunting: Security analysts gain direct visibility into these detections through Microsoft Defender XDR. Extracted QR code URLs are logged in the MessageUrlInfo table with QRCode recorded in the UrlLocation column, enabling SOC teams to track quishing vectors during investigations.
Conclusion
This update enhances Microsoft Teams’ defense against quishing tactics, which bypass traditional text-based filters by embedding malicious links inside images. Because this is a post-delivery control, organizations must combine automated Defender protections with employee vigilance and robust incident response workflows.
To prepare for and leverage this update, security teams should verify that Microsoft Defender for Office 365 and Teams ZAP configurations are fully enabled. Administrators should brief security operations staff on the new QRCode indicator values within the MessageUrlInfo hunting table and update incident response playbooks to account for QR-based threat vectors.
Finally, organizations should continue educating employees to verify unexpected scanning requests—especially urgent prompts regarding account verification or IT support—through trusted out-of-band channels.
Source