Source: Cyber Security News, GBHackers, Microsoft 365 Message Center notice MC1490905
Microsoft is extending Teams security to detect malicious links hidden inside QR codes and warn users after a message has been delivered. Announced through Microsoft 365 Message Center notice MC1490905 and rolling out worldwide from early October through early November 2026, the update adds QR code checks to the existing Microsoft Defender for Office 365 protections. Organizations with Defender for Office 365 Plan 1 or Plan 2 will receive the enhancement automatically, with no separate setup required.
What actually changes
After a Teams message is delivered, Defender extracts the web addresses stored inside any QR code in the message and evaluates whether they point to malicious content. If a dangerous URL is found, Teams displays a warning on the affected message in both internal and external conversations. Where Zero-hour Auto Purge for Teams is enabled, eligible malicious internal messages can also be blocked after delivery. Security teams gain new visibility through Microsoft Defender XDR Advanced Hunting, where extracted QR code addresses are recorded in the MessageUrlInfo table with the URL location noted as a QR code. This update complements the earlier Teams protection for external senders, which hides QR images until a user chooses to reveal them, so the two controls address different stages of exposure.
Why quishing is climbing the priority list
QR code phishing, often called quishing, embeds the malicious destination in an image instead of a clickable text link. That defeats the visual habits users have been trained on, such as hovering over a link to inspect the address, and the encoded URL may only become visible after the victim scans the image with a phone, moving the attack away from desktop security controls entirely. Attackers are shifting phishing activity into collaboration platforms because that is where trust is highest and traditional email filtering does not reach. Microsoft recommends reviewing existing Teams protection settings and ZAP configuration, informing security operations staff about the new hunting data, and updating investigation processes to include QR detections.
For European organizations running Microsoft 365, this rollout is a good moment to review the whole configuration, from Defender policies and quarantine settings to user reporting workflows. If you want experienced eyes on your Microsoft 365 security posture or help building phishing resilience across Teams and email, contact Excello Digital at https://excello.digital/contact/. We configure and tune these protections for a living.