Microsoft Teams is updating its platform with a new security feature designed to automatically obscure QR codes sent by external users, mitigating the rising threat of QR-code-based phishing and credential theft attacks.
According to the official Microsoft 365 Roadmap entry 570439, the upcoming protection mechanism will automatically hide any images containing QR codes originating from senders outside of an organization’s network. Users will be required to explicitly click to reveal the image before they can view or scan the embedded code.
The feature is currently in active development, with a targeted rollout slated to begin in October 2026. The security update will be deployed across multiple client platforms, including desktop, Android, iOS, and Mac applications.
“Microsoft Teams will provide additional protection for QR codes shared by external users in messages. Images containing QR codes from external senders will be obscured by default and require users to reveal them before viewing or scanning,” Microsoft noted in the roadmap documentation.
The modification addresses inherent risks associated with quick response codes, which inherently obscure their destination URLs and underlying data payloads until scanned by a device. Threat actors frequently exploit this limitation by embedding malicious links or malware delivery vectors inside legitimate-looking images.
“This helps reduce the risk of phishing and fraud by encouraging more deliberate interaction with QR code content,” Microsoft stated regarding the functional intent of the update.
Recent threat intelligence data underscores the urgency of such interface safeguards. According to research from NordVPN, approximately 73% of users scan QR codes without verifying their destination, resulting in millions of individuals being unknowingly redirected to malicious websites. Furthermore, regulatory bodies such as the U.S. Federal Trade Commission have issued repeated consumer advisories warning against scanning unexpected QR codes found on physical packages or digital correspondence.