Microsoft is adding a security control to Teams that most enterprises will quietly appreciate once they understand what it's blocking: starting October 2026, Teams will automatically blur QR codes sent by external users — guests, vendors, contractors — until the recipient manually reveals them.
Why this matters technically:
QR codes are a phishing blind spot because the destination URL is invisible until decoded. A malicious hyperlink pasted into a chat can be inspected — hovered, copied, checked against a blocklist. A QR code embedded in an image skips that entirely. Most secure email gateways and chat-based URL scanners were built to parse text, not decode pixels inside an image, which is exactly the gap "quishing" campaigns have been exploiting.
A realistic attack chain looks like this: an attacker compromises or spoofs an external contractor's Microsoft 365 account, references a real project for credibility, then sends a QR code framed as a "secure document link." Because it renders as an ordinary image in the chat, it doesn't trigger the same caution a suspicious link would. The employee scans it, lands on a cloned Microsoft sign-in page, and hands over session credentials without leaving what felt like a normal work conversation.
Listed under Microsoft 365 Roadmap ID 570439, the fix doesn't block QR codes outright — it adds a deliberate friction point. The image stays obscured until the user actively chooses to reveal it, covering Teams on Desktop, Mac, Android, and iOS for the Worldwide Standard Multi-Tenant cloud.
For security and IT teams, a few things worth building around this:
- Don't treat "revealed" as "verified" — train users to confirm unexpected QR codes through a separate channel
- Tighten external access and guest policies at the tenant level
- Layer in phishing-resistant MFA so stolen credentials aren't enough on their own
- Add Teams-based QR lures to your next phishing simulation cycle — most platforms still only cover email
Full technical breakdown, attack scenario, and detection checklist:
https://www.xpert4cyber.com/2026/09/microsoft-teams-qr-code-protection.html
Top comments (0)