Microsoft Teams to block QR code phishing

Microsoft has announced that Teams will soon hide QR codes sent by people outside a user’s organization, requiring a manual reveal before the image can be viewed or scanned. The change is intended to make QR code phishing attacks harder and will begin rolling out in October 2026 across Android, iOS, desktop and Mac clients.

The protection targets external participants who share QR images in chats or channels. QR codes have become a convenient way for attackers to direct victims to malicious websites, download malware, or harvest credentials. By obscuring the code until a user clicks “show image,” Teams adds a friction point that can give users time to consider the source before scanning.

The feature is still in development, and Microsoft says it will be enabled by default for all Teams users. Internal messages will continue to display QR codes normally, as the risk is lower when the sender is trusted. The company has not disclosed any performance impact or additional settings for administrators.

Users can protect themselves now by treating any unexpected QR code with suspicion, especially if it arrives from an unknown contact. Verify the sender’s identity through a separate channel before scanning, and consider using a QR scanner that shows the embedded URL without opening it. Free tools such as the QR Code Checker on ComputerScams.com can help identify suspicious links.

While the upcoming hide‑and‑reveal function adds a layer of defense, it does not eliminate the threat entirely. Attackers may still embed malicious URLs in other image formats or use text links. Maintaining strong password security, keeping software up to date, and being vigilant about phishing emails remain essential parts of cyber security hygiene.

A simple step you can take today is to hover over any QR code with a scanner app that previews the destination URL before you click, giving you a chance to spot malicious links without exposing your device.

Source: Read the original report