techcommunity.microsoft.com
Open in
urlscan Pro
173.222.147.25
Public Scan
URL:
https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/protect-your-organizations-against-qr-code-phishing-with/ba-p/4...
Submission: On January 08 via manual from SG — Scanned from SG
Submission: On January 08 via manual from SG — Scanned from SG
Form analysis 2 forms found in the DOM
Name: form_99365f8db14b7a — POST https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.searchformv32.form.form
<form enctype="multipart/form-data" class="lia-form lia-form-inline SearchForm" action="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.searchformv32.form.form" method="post" id="form_99365f8db14b7a" name="form_99365f8db14b7a">
<div class="t-invisible"><input value="blog-id/MicrosoftDefenderforOffice365Blog/article-id/449" name="t:ac" type="hidden"><input value="search/contributions/page" name="t:cp" type="hidden"><input
value="UKTQ8CQTKJJgtTrzCxISL5yPMClNQ79oEzhFc8l77EMDO1a_mEB3UBS3v7SBNwrOXwPO-NO32D_08keeS0XuIYRiwGOQh8g64NMTRxarfR-KGCLhz3Ptulcc5-GRUkYA0Y-yBtO26PhBMvdNCzmMcQeTnidyROCXG1_VzIVaS6uoLvaYmzJOwfxpVKWe-DeQVkMj0Ni3G_0pD6m6wb_LSSadf201Hssd44xqUUhN7xx1ByAXBN8b-FadyJmbsnQPAVJwWSTofaeOPtz_ypDYlpxgl0ZeWzG3ec4wahGoHkubQFIedo4chme5y5i0rd-62PEbFMYY9XwqOAzhH4tnQcYT35NpoyfCCp7FzkX0dN0VzhF1_zqL7HXAOrS6iftDv6ac954-5pxQpko08QNUd8g9Don5xUHSXpZwtOID8f5OZYfXjhKRNU-IxamnHB6_40bzy9qaFDPaTA-YMks1YhcaihrbjlEf_i-JyvhcKuybh9HxVXx9eqImR24r81U-zP8wcMAUwP2FpnZ1-qSA6PjCCtdKbwyMaXD55qAC694nRWNiXJF4vV866kFx0z2WTda0F_hQ3Y0StzwkvjpEW004wqfBP3POoOsPO2Oz3R4sg4rwGJNGZwzWOQhxObNbE70NU-qu0OSoD1d5-DL_XXid_D2pr-6PT_xgF6YADM_xo7qhyEJq68XwFoU49ZBEvRv04t4_Z0L7IbQdsILcLt02fPw9Vyi5OGAziR25gqPPeoALdR1EdGB7dAhlZ9x3R8R0PgED6cssFdkyfcPKRKpgZZom47T3fmJkh8qN_jnTizeSoeybz8f-S-mCoWi5W0LFsXZ8s2qs1fkROO5zA2eyFyZKr_cD4CSN7xnJ47d0jUxSB9Xukfhlo7eZ8xWFsK4KAOzK9AYKFWqzELJaDOsA1ucF91D_yvIP8E5puxbU-kkfs1ZI3xCrMxzcxO5BWXVvzNYZjET-xHkb3F9k_gOgWYTRG5X8WvVU-Cslc2rufUgKMDp1lORgS_YbqgTgQh8JyKAb6ynw8gMnBL_z2-8GDoUkqzZl0y4o7SiY2QnDZhVoH3cbt8WpE9PgbllAFxrOgellSC5_h8P7tXPKOWWB0xiDu4-druIi8TZSHDjWQdJUmeOKAT5eYfR1HvsJc8vZK8J-UwgkmVsFhAxj6MqpCVcLBif8vHm1VQkCqfD3uuzyf99h8Vc9C4BpwUVpkmf0Hp2__jZlCoiv1-bka-g6r3IrJxYEc31NS7auuH2kwpq9bd9ZDS3gSqftsY54v9ejv1RtsWsQyAeWzfE8uw.."
name="lia-form-context" type="hidden"><input value="BlogArticlePage:blog-id/MicrosoftDefenderforOffice365Blog/article-id/449:searchformv32.form:" name="liaFormContentKey" type="hidden"><input
value="yDZKQFNI0U/sd9X4pbUemqvQQZw=:H4sIAAAAAAAAALWSzUrDQBSFr4Wuigiib6DbiajdqAhFUISqweBaZibTNJpk4sxNEzc+ik8gvkQX7nwHH8CtKxfmzxJbwaTUVZhzw/nOmblP79COD+FAC6r40OAyQOWyCF0ZaMOkjtgrJgOp/NHONtER810sP9nfIkGtoCuVQ2hI+VAQpKHQqO67hEslPJcRRrUgPZaKlOOxKzx7wxIYhZtX487b+stnC5b60MnZ0junvkBY7d/QETU8GjiGlUYKnP0kRFguwEcFeAHBe02Dm0pyobWV+Wid0sbP9u7g4/G1BZCE8QWc1U3kpzapWoqZ+S+SvoMHgPQ+ypGVj/IoC2dlqHZ8CWZdV7xljUqszZa43voPYNHkFE7qGkdaqKrl1Pm7wEqmV59gcYjGkQOJP25h6jyJnOlzRv4DUURusIWhknbEsWo5K002vhzNufG1WHmDLwdzh8gDBQAA"
name="t:formdata" type="hidden"></div>
<div class="lia-inline-ajax-feedback">
<div class="AjaxFeedback" id="feedback_99365f8db14b7a"></div>
</div>
<input value="-RKD_dY8_R64_UQt_zUVeLjkTaBbM0uh3RMzthZjiuY." name="lia-action-token" type="hidden">
<input value="form_99365f8db14b7a" id="form_UIDform_99365f8db14b7a" name="form_UID" type="hidden">
<input value="" id="form_instance_keyform_99365f8db14b7a" name="form_instance_key" type="hidden">
<span class="lia-search-input-wrapper">
<span class="lia-search-input-field">
<span class="lia-button-wrapper lia-button-wrapper-secondary lia-button-wrapper-searchForm-action"><input value="searchForm" name="submitContextX" type="hidden"><input class="lia-button lia-button-secondary lia-button-searchForm-action"
value="Search" id="submitContext_99365f8db14b7a" name="submitContext" type="submit" tabindex="-1"></span>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-message" value="" id="messageSearchField_99365f8db14b7a_0" name="messageSearchField"
type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="_B-Ug3g9BU1vp6LzUbs4A8P6YGEsatf1FqDT0ZZ7bfo." rel="nofollow" id="disableAutoComplete_99365f8e073680" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-tkb-article lia-js-hidden" value="" id="messageSearchField_99365f8db14b7a_1"
name="messageSearchField_0" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="PnW5ygmcMnYiaA12_p1uEotWXVtJyeUqTfZS6jFTIHk." rel="nofollow" id="disableAutoComplete_99365f8f0f5737" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Enter a keyword to search within the users" ng-non-bindable="" title="Enter a user name or rank" class="lia-form-type-text UserSearchField lia-search-input-user search-input lia-js-hidden lia-autocomplete-input"
aria-label="Enter a user name or rank" value="" id="userSearchField_99365f8db14b7a" name="userSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a user name or rank</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="vG-Ed-u5FfLFFfdCxTHIrIhW6WrzJ6De9GFc5zHwgGs." rel="nofollow" id="disableAutoComplete_99365f8f683cbe" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Enter a keyword to search within the private messages" title="Enter a search word" class="lia-form-type-text NoteSearchField lia-search-input-note search-input lia-js-hidden lia-autocomplete-input"
aria-label="Enter a search word" value="" id="noteSearchField_99365f8db14b7a_0" name="noteSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="n5g3Vo7WCKsXCvWs5XDz4wAfSjTe8lHvW3fXGYpypv4." rel="nofollow" id="disableAutoComplete_99365f8fbf3f10" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input title="Enter a search word" class="lia-form-type-text ProductSearchField lia-search-input-product search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="productSearchField_99365f8db14b7a"
name="productSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="W8p7JItV8m1H3SbqFt34ZRNVV5jeCqpkwPDaO2Cm8C8." rel="nofollow" id="disableAutoComplete_99365f8ff90945" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input class="lia-as-search-action-id" name="as-search-action-id" type="hidden">
</span>
</span>
<span class="lia-cancel-search" tabindex="0">cancel</span>
</form>Name: form — POST https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.searchformv32.form.form
<form enctype="multipart/form-data" class="lia-form lia-form-inline SearchForm" action="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.searchformv32.form.form" method="post" id="form" name="form">
<div class="t-invisible"><input value="blog-id/MicrosoftDefenderforOffice365Blog/article-id/449" name="t:ac" type="hidden"><input value="search/contributions/page" name="t:cp" type="hidden"><input
value="WCOLfG00JzDfNQgmG0kAUR_MrT-M5gFHi6QYC8NRvz1WboygP7p9p30ekuIl_MTNqVqaJFMgKllsEmgfQb_xculml2AnFMnCAFp7qqWDlLIpy0GU52iPTlXpP0ih-Lp41JaxI-6fya3TgVBMQmQE0bLM22X2HQWxnMNY0bOu_9LYLG7QCJCZyWIG7rlorUM-DLvJfduz8G3DbFM7goLzI88bHJbvkhpHjL1c5oYNWpfO2x35DOmjyyAXFUn9woX_0dKlMMtlFD9WmY01846vnmZPEnaoVLIVCEFGThsAOxeII8t-8rhGY7qYut5ztHPxY_r1aHaTZSRzNe-BHGpmTdqLZDR7RAbBvYLfNrX5seZwbBUuza5asv3Ab2SLDUxiiNpZDuiX_-JsGBKtdaVffWu0CBiT-9jZRDQnv0HVO-ubM2hBGgMKiXIa7c6EAYIMNA8ktF6GmIhnJtw7KYeOUIGncFV1bxnBYlqyXvBXHw3Wil-Z0JyG2mI6rgrnZhAZ7xWFeXSzk6M4xIK7H34w0alciJNaScPG1zk5kDJ_2tsVGWvI-ZLOUu7CO5_LongMJCyhH6QY0jmuSHQc1eyfgVme3qs30rlAfdAEsoPTmscALWSe3BMJgVn2BNvyKpBmUo-DL9lQ4KozdX3x6Wq34gnesDy3XJpDTwYnxV8aJZ_KG3HyCAFtandI5ZPXE-IVO3GEDMGY40gqWuI_gVwXDQsJVd18hbYmi6PUUFqlGMAPLZdWHqKwjLyI0YB4Nt8HbA4OHW23vzRnawrO9nFi8ofx9yFpCxOezMvKBexgx4VbUygA31xwv6gFy_msbRLw7sDMy_U8F1bup-SlPEVsTfQwWuzyVm1tfro3u5-Ipacj09guvCrh90EJmojviP9wltGXGkIVwSj0VPlzpIJPkT1NJJkrNmLr76uWRCyINPg7gjYDEcxeZNm3C2JEnKhI9e4BLLSWi6gkbOq7pjtqQ98ZHPB7jiRhotJfgs1BsJpW4oEnDF8c8C2zZOLCsDcBE7wCrsEFfBbPNdFh84OSEyZETtv6cAWmju4zBr3m8B8oTgzNDyNPmslspnwL_wHb4-ujSIMkrThUCcnyNVboC4Un41KbWJ-_xMaig3OV1PMuxXL84URhmoCAzgLEcAJ67SJTp1MtS0HVPZ5r4lJS3kaD0T1qfJGVS794m9pVhVc."
name="lia-form-context" type="hidden"><input value="BlogArticlePage:blog-id/MicrosoftDefenderforOffice365Blog/article-id/449:searchformv32.form:" name="liaFormContentKey" type="hidden"><input
value="yDZKQFNI0U/sd9X4pbUemqvQQZw=:H4sIAAAAAAAAALWSzUrDQBSFr4Wuigiib6DbiajdqAhFUISqweBaZibTNJpk4sxNEzc+ik8gvkQX7nwHH8CtKxfmzxJbwaTUVZhzw/nOmblP79COD+FAC6r40OAyQOWyCF0ZaMOkjtgrJgOp/NHONtER810sP9nfIkGtoCuVQ2hI+VAQpKHQqO67hEslPJcRRrUgPZaKlOOxKzx7wxIYhZtX487b+stnC5b60MnZ0junvkBY7d/QETU8GjiGlUYKnP0kRFguwEcFeAHBe02Dm0pyobWV+Wid0sbP9u7g4/G1BZCE8QWc1U3kpzapWoqZ+S+SvoMHgPQ+ypGVj/IoC2dlqHZ8CWZdV7xljUqszZa43voPYNHkFE7qGkdaqKrl1Pm7wEqmV59gcYjGkQOJP25h6jyJnOlzRv4DUURusIWhknbEsWo5K002vhzNufG1WHmDLwdzh8gDBQAA"
name="t:formdata" type="hidden"></div>
<div class="lia-inline-ajax-feedback">
<div class="AjaxFeedback" id="feedback"></div>
</div>
<input value="gg8SS1BytfNXrLuFtLYmjXqkJki4vS0VwuCSz_kwpgM." name="lia-action-token" type="hidden">
<input value="form" id="form_UIDform" name="form_UID" type="hidden">
<input value="" id="form_instance_keyform" name="form_instance_key" type="hidden">
<span class="lia-search-input-wrapper">
<span class="lia-search-input-field">
<span class="lia-button-wrapper lia-button-wrapper-secondary lia-button-wrapper-searchForm-action"><input value="searchForm" name="submitContextX" type="hidden"><input class="lia-button lia-button-secondary lia-button-searchForm-action"
value="Search" id="submitContext" name="submitContext" type="submit" tabindex="-1"></span>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-message" value="" id="messageSearchField_0" name="messageSearchField" type="text"
aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="_XgwygzxhJ5VqzvR2oSpvICMCM644uMlTK6fWMA3EBE." rel="nofollow" id="disableAutoComplete_99365f90a4970d" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-tkb-article lia-js-hidden" value="" id="messageSearchField_1"
name="messageSearchField_0" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="MrM_nPe_6LTuEFzkMiq1oTbnREh1EbOklEouQ-mOz2w." rel="nofollow" id="disableAutoComplete_99365f90e82a59" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Enter a keyword to search within the users" ng-non-bindable="" title="Enter a user name or rank" class="lia-form-type-text UserSearchField lia-search-input-user search-input lia-js-hidden lia-autocomplete-input"
aria-label="Enter a user name or rank" value="" id="userSearchField" name="userSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a user name or rank</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="C0yYnfhEOGdsTSDHJ3_CVFv01fk6CNFlxlWxQEw1NRE." rel="nofollow" id="disableAutoComplete_99365f912a5b59" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Enter a keyword to search within the private messages" title="Enter a search word" class="lia-form-type-text NoteSearchField lia-search-input-note search-input lia-js-hidden lia-autocomplete-input"
aria-label="Enter a search word" value="" id="noteSearchField_0" name="noteSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="tv4eBvYJW_iB4X7IQTrppOv9I1k9nCJAebJvR4bBHEU." rel="nofollow" id="disableAutoComplete_99365f916df549" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input title="Enter a search word" class="lia-form-type-text ProductSearchField lia-search-input-product search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="productSearchField"
name="productSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="dkieB9XLtr5Liu5RqLrI9HVGRyzNa4hvMS5BxTtEau4." rel="nofollow" id="disableAutoComplete_99365f91a38d45" href="https://techcommunity.microsoft.com/t5/blogs/v2/blogarticlepage.disableautocomplete:disableautocomplete?t:ac=blog-id/MicrosoftDefenderforOffice365Blog/article-id/449&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input class="lia-as-search-action-id" name="as-search-action-id" type="hidden">
</span>
</span>
<span class="lia-cancel-search">cancel</span>
</form>Text Content
Skip to Main Content
Microsoft
Tech Community
Home
Community Hubs
Community Hubs
* Community Hubs Home
* Products
* Special Topics
* Video Hub
Close
PRODUCTS (52)
SPECIAL TOPICS (28)
VIDEO HUB (447)
MOST ACTIVE HUBS
Microsoft 365
Microsoft Teams
Windows
Outlook
Security, Compliance and Identity
SharePoint
Azure
Windows Server
Exchange
Intune and Configuration Manager
Microsoft Edge Insider
OneDrive
Microsoft Viva
Connect and learn from experts and peers
Microsoft FastTrack
Best practices and the latest news on Microsoft FastTrack
Microsoft Sales Copilot
A role-based copilot designed for sellers
MOST ACTIVE HUBS
Education Sector
ITOps Talk
AI and Machine Learning
Microsoft Mechanics
Microsoft Partner Community
Healthcare and Life Sciences
Internet of Things (IoT)
Public Sector
Mixed Reality
Small and Medium Business
Startups at Microsoft
Azure Partner Community
Expand your Azure partner-to-partner network
Microsoft Tech Talks
Bringing IT Pros together through In-Person & Virtual events
MVP Award Program
Find out more about the Microsoft MVP Award Program.
VIDEO HUB
Azure
Exchange
Microsoft 365
Microsoft 365 Business
Microsoft 365 Enterprise
Microsoft Edge
Microsoft Outlook
Microsoft Teams
Security
SharePoint
Windows
Browse All Community Hubs
Blogs
Blogs
Events
Events
* Events Home
* Microsoft Ignite
* Microsoft Build
* Community Events
Microsoft Learn
Microsoft Learn
* Home
* Community
* Blog
* Azure
* Dynamics 365
* Microsoft 365
* Security, Compliance & Identity
* Power Platform
* Github
* Teams
* .NET
Lounge
Lounge
* 1.3M Members
* 21.6K Online
* 314K Discussions
Search
Enter a search word
Turn off suggestions
Enter a search word
Turn off suggestions
Enter a user name or rank
Turn off suggestions
Enter a search word
Turn off suggestions
Enter a search word
Turn off suggestions
cancel
Turn on suggestions
Showing results for
Show only | Search instead for
Did you mean:
Sign In
Sign In
Enter a search word
Turn off suggestions
Enter a search word
Turn off suggestions
Enter a user name or rank
Turn off suggestions
Enter a search word
Turn off suggestions
Enter a search word
Turn off suggestions
cancel
Turn on suggestions
Showing results for
Show only | Search instead for
Did you mean:
* Home
* Security, Compliance, and Identity
* Microsoft Defender for Office 365 Blog
* Protect your organizations against QR code phishing with Defender for Office
365
* Back to Blog
* Older Article
Protect your organizations against QR code phishing with Defender for Office 365
* Subscribe to RSS Feed
*
* Mark as New
* Mark as Read
*
* Bookmark
* Subscribe
*
* Printer Friendly Page
* Report Inappropriate Content
By
Urja Gandhi
Published Dec 12 2023 12:12 PM 31.7K Views
Listen to the article
00:0000:00
00:00
Powered by
undefined
UrjaGandhi
Microsoft
Dec 12 2023 12:12 PM
PROTECT YOUR ORGANIZATIONS AGAINST QR CODE PHISHING WITH DEFENDER FOR OFFICE 365
Dec 12 2023 12:12 PM
QR code phishing campaigns have most recently become the fastest growing type of
email-based attack. These types of attacks are growing and embed QR code images
linked to malicious content directly into the email body, to evade detection.
They often entice unwitting users with seemingly genuine prompts, like a
password reset or a two-factor authentication request. Microsoft Defender for
Office 365 is continuously adapting as threat actors evolve their methodologies.
In this blog post we’ll share more details on how we’re helping defenders
address this threat and keeping end-users safe.
What is a QR Code?
A QR code (short for "Quick Response code") is a two-dimensional barcode that
can be scanned using a smartphone or other mobile device equipped with a camera.
QR codes can contain various types of information, such as website URLs, contact
information, product details, and more. They are most commonly used for taking
users to websites, files, or applications. The easiest way to think about a QR
code is to treat it just as you would a URL.
For example, when this QR code is scanned it will redirect you to the Defender
for Office 365 product page.
QR Code Phishing on the Rise
Over the last few years QR Codes have seen a rise in popularity in legitimate
use scenarios, in part due to COVID. You have probably seen them in restaurants,
parking lots, and marketing. In 2022, The Federal Bureau of Investigation raised
awareness about cybercriminals tampering with QR codes to steal financial funds
from victims. And while until very recently QR Code phishing attacks were
relatively rare, around mid-September 2023, Microsoft Security Research & Threat
Intelligence observed a significant increase in phishing attempts related to
QR-codes. Our telemetry showed a 23% increase in attacks using this exploit
within one week alone.
So why use QR codes for phishing?
QR Codes present a unique challenge for security providers as they appear as an
image during mail flow and are unreadable until rendered. Once the QR Code is
rendered (what the human eye sees) it can then be scanned/processed for further
analysis.
QR codes are used in phishing attacks for mainly two reasons:
1. They move the attack away from well-protected corporate environments and
onto the victim’s personally owned mobile device, which may be less secure.
2. They leverage the most common credential theft vector which is the uniform
resource locator (URL).
A QR code can be easily manipulated to redirect unsuspecting victims to
malicious websites or to download malware in exactly the same way as URLs, only
by putting the URL in a more difficult-to-detect location. Adversaries craft QR
codes to look legitimate, for example a message coming from an IT Administrator,
and when scanned will ask the user to verify their account via their credentials
or download a malicious file onto the user's device. This is becoming more
common as the constrained screen size of mobile devices can make warning signs
of phishing attacks difficult for users to recognize.
The multiple layers of tactics, techniques and procedures (TTPs) reveal various
patterns of QR Code Phishing messages seen by Defender for Office 365. This
includes but is not limited to:
* URL redirection
* Minimal to no text (reducing signals for ML detection)
* Abuse of known brands
* Abuse of sending infrastructure known for sending legitimate emails
* A variety of social lures including 2 factor auth, document signing, and more
* Embedding QR codes in attachments
A few examples below:
QR Codes are embedded as inline images within email body
In the example below, the QR code is embedded inline within the body of the
email, which when scanned redirects the user to a phishing website attempting to
gather their credentials.
Figure 1: QR code as an image within email body redirecting to a malicious
website.
QR Code within an image in the email body
In the example below, the QR code is placed inside an image embedded inline
within the body of the email.
Figure 2: QR code inside of an image within email body attempting to redirect to
a malicious website.
QR Code as an image in an attachment
In the example below, the QR code is embedded inside an attachment that is a
PDF, which when scanned redirects the user to a phishing website attempting to
gather their credentials.
Figure 3: QR code as an image within an attachment sent via email attempting to
redirect to a phishing website.
*The QR codes displayed in the examples above originally redirected to malicious
websites. Note: they have been replaced to redirect to a legitimate website to
prevent users who scan them from being a victim of phishing.
How Defender for Office 365 detects QR Code phishing
Given these attack techniques, it is clear that QR code phishing is functionally
identical to credential harvesting. Let’s take a closer look at how Defender for
Office 365 protects against them. The below detection capabilities are available
in Exchange Online Protection & Microsoft Defender for Office 365 licenses.
Based on the specific license, the checks will vary as mentioned below.
Image Detection
With advanced image extraction technologies, Defender for Office 365 and
Exchange Online Protection detects a QR Code in a message inline during mail
flow. The system extracts URL metadata from a QR Code and feeds that signal into
our existing threat protection and filtering capabilities for URLs. By using
these signals, the underlying URL can also be sent to a sandbox environment for
detonation and the malicious threats are proactively identified and blocked
before they reach a user’s mailbox.
Threat Signals
Defender for Office 365 and Exchange Online Protection uses a variety of mail
flow signals to determine and act on a message. Essentially, no single input
determines the final classification of an email. It is always a composite of
several signals to construct a robust context. The QR Code signal is used in
combination with sender intelligence, message headers, recipient details,
content filtering, and the relationships shared between them are fed into
machine learning algorithms to produce the highest quality verdict as the
context permits.
URL Analysis
The URLs extracted from QR Codes are analyzed by machine learning models,
checked against both internal and external sources of reputation and for
Microsoft Defender for Office 365 Plan 1 / Plan 2 licenses are sandboxed for
further investigation as needed to assess the risk for detonation.
Heuristics-based Rules
Microsoft also deploys heuristic rules within Defender for Office 365 and
Exchange Online Protection to reason over and block malicious messages. This
capability constitutes one of our most flexible and fastest moving mitigations,
and it is used extensively to mitigate attack patterns as they morph day to day
during major campaigns such as the QR Code phishing.
Microsoft Defender for Office 365 blocks QR Code Phishing at Scale
Here are a few datapoints that help put this strategy into perspective:
* With the power of existing capabilities and robust tools we have built, many
heuristics-based rules were released within minutes leading to ~1.5 million
QR code phishing blocked in email body per day in the last several months! As
the attack patterns evolve, new rules continue to get released and refined as
needed.
* The advanced detection technologies built to extract QR code related metadata
(URL and text), have scanned more than 200 million unique URLs on average
weekly, out of which more than 100 million came from QR codes.
* Our advanced detection technologies have blocked more than 18 million unique
phishing emails containing a QR code image in the email body on average
weekly and around 3 million unique QR code phishing emails per day.
* QR code phishing protection includes Commercial as well as Consumer emails.
More than 96% of these are QR code phishing blocked by our technologies in
Enterprise alone.
Figure 4: QR code phishing blocked by Microsoft Defender for Office 365
We continually track threat actor activity and evolve our detections to combat
new and evolving techniques and patterns.
What can you do to stay protected?
Extended Detection and Response (XDR): Microsoft Defender XDR provides
comprehensive defense against advanced threats like QR code phishing, offering
end-to-end protection with unified detection, investigation, and response
experience. With native integration across endpoints, hybrid identities, email,
collaboration tools, and cloud applications, XDR enables centralized visibility,
powerful analytics, and automatic attack disruption against even the most
sophisticated malicious actors. QR code phishing often targets account
identities through adversary-in-the-middle (AiTM) attacks, intercepting
credentials and session cookies. Attacks like these can be effectively disrupted
by Microsoft Defender XDR, thanks to its holistic approach to detection. By
correlating signals across products into high-fidelity detections, Defender XDR
disrupts attacks early, limiting their impact and progression, and safeguarding
organizations before they can cause widespread damage.
Endpoint Protection: Users scan QR codes using their mobile devices, opening the
embedded URL in the device web browser. Microsoft Defender for Endpoint on
Android and iOS includes anti-phishing capabilities that also apply to QR code
phishing attacks, blocking phishing sites from being accessed. Microsoft
Defender for Endpoint also provides protection against malware that may be
downloaded or installed through the URL link.
End-User Training: Defender for Office 365 customers can use Attack Simulation
Training to educate their end users by simulating real-world phishing attacks
and other types of cyber threats. This training can help users recognize the
signs of a phishing attack, such as suspicious emails or links, and can teach
them how to respond appropriately to these threats. Attack Simulation Training
can also provide users with feedback and guidance on how to improve their
security practices, such as by enabling multi-factor authentication. By using
Attack Simulation Training, organizations can help their end users become more
aware of potential threats and better equipped to protect themselves and their
organization against cyberattacks. In order to participate in a Private Preview
for QR code-based simulations using Attack Simulation Training, please join our
Customer Connection Program and sign up for the preview slated for CY24Q1.
Protection beyond QR code phishing with Defender for Office 365
The rise of QR code phishing is part of a larger technique shift carried out by
threat actors to leverage images as part of social engineering tactics in order
to bypass Enterprise Security defenses. Our recent QR code phishing detection
capabilities are only a part of a larger robust solution to defend against
varied forms of image-based attacks. This includes QR codes, bar codes, brand
logos etc.
It's important to be cautious when scanning QR codes from unknown sources and to
always verify the legitimacy of the email and its contents before taking any
action. To learn more, check out an episode on QR code protection from November
27th PST on our virtual ninja show.
On a periodic basis, be sure to review the configuration settings within your
organization’s policies, manage and monitor the priority accounts within the
organizations as such, review any mail flow rules you might have added to
maintain a secure posture. Further, use step-by-step guides to help you quickly
configure anti-malware policies, anti-phishing policies, safe attachments and
much more. Remember that it is possible for attackers to weaponize content or
URL even after the delivery of a message. Therefore, it is highly recommended to
use the submissions workflow to submit the false positive or false negative
samples to Microsoft for further analysis and help the system automatically
learn the patterns from the submissions.
Do you have questions or feedback about Microsoft Defender for Office 365?
Engage with the community and Microsoft experts in the Defender for Office 365
forum.
Urja Gandhi
11 Likes
Like
15 Comments
Brian Reid
MVP
Dec 13 2023 12:39 AM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 13 2023 12:39 AM
Can we please have some clarifications on the license requirements that are
missing from this article. There is considerable mention of Defender for Office
(MDO), both plans, and occasionally a mention of Office 365, and no mention of
Exchange Online Projection (EOP). EOP is your baseline for mail flow protection
and MDO requires additional licenses but works across multiple services such as
Teams as well as email.
Nowhere in this article do you distinguish between what is available if all I
have in Microsoft 365 is a mailbox and what functionality needs MDO. Also it
would be useful to know if the QR code metadata extraction applies to links in
Teams chats (as MDO will protect these with SafeLinks) and also attachments in
SharePoint / OneDrive or Forms.
Thanks
Brian Reid
4 Likes
Like
michaelkennedy
Copper Contributor
Dec 13 2023 01:40 AM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 13 2023 01:40 AM
Is this something that needs to be configured?
Can we not treat QR codes in email the same as .exe files, and offer the ability
to block them entirely? QR Codes on billboards and other physical locations make
sense, but QR codes in email are redundant, and are solely used as a vector for
attack.
3 Likes
Like
Brian Wilson
Copper Contributor
Dec 13 2023 06:00 AM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 13 2023 06:00 AM
About time. I'd be curious when MS actually started tracking those metrics.
This threat been around for several months and other supplemental email security
products have been detecting and protecting users from it for awhile. Being
late to the game once is understandable, but how is Microsoft going to ensure
that the next 'tactic of the month' is prioritized for their customers?
2 Likes
Like
M_Wilkinson_
Copper Contributor
Dec 13 2023 08:21 AM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 13 2023 08:21 AM
If a 3rd party mail gateway is in place with ETR / IP Connection Policy. Is this
protection not enforced unless Enhanced Filtering is enabled?
0 Likes
Like
jasonchrist
Copper Contributor
Dec 13 2023 05:54 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 13 2023 05:54 PM
Just a suggestions,
Since you already parsed the QR code URL into EmailUrlInfo table,
instead of saying it's from Attachment, could you mark it as "QR" instead?
Or additional column saying that this is from QR, since the system know it's
parsed from QR anyway.
thank You.
1 Like
Like
UrjaGandhi
Microsoft
Dec 13 2023 09:39 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 13 2023 09:39 PM
@Brian Wilson As mentioned in the blog, while this threat is not new, it has
recently grown significantly! Once the Microsoft Security Research and Threat
Intelligence team saw a spike in these attacks, a high priority incident process
was initiated within hours and the Research and Product Engineering teams were
engaged to triage and analyze the threat. In general, our process during these
attacker-driven incidents is to triage the risk, identify key campaign
signatures, mitigate quickly with tools at hand, and then implement more durable
preventions for the long term at scale. Also, as stated in the blog, we
continually track threat actor activity and evolve our detections to combat new
and evolving techniques and patterns.
1 Like
Like
ExMSW4319
Iron Contributor
Dec 14 2023 01:57 AM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 01:57 AM
As previously suggested by posters, just giving us some attribute or property
indicating that a QR code is present would be a help. If a new predicate is a
lot of work, I would settle for an X-QR-code: present SMTP header if it is in
the message in time for mail flow rules to react.
1 Like
Like
rdelvalle
Copper Contributor
Dec 14 2023 01:13 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 01:13 PM
With the holidays in full swing, this is something that has been needed for a
while.
1 Like
Like
UrjaGandhi
Microsoft
Dec 14 2023 01:45 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 01:45 PM
@jasonchrist Thank you for the feedback, this is work in progress. The hunting
and end user training experiences are planned to be tentatively released in
CY24Q1. Instead of the Source being “Attachment” under URL, it will show “QR
code” in the future indicating the URL came from a QR code.
1 Like
Like
UrjaGandhi
Microsoft
Dec 14 2023 01:59 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 01:59 PM
@ExMSW4319 Thanks for the suggestion, there are no plans to incorporate this
kind of information in the headers. What will rather be beneficial is to view
information in the hunting and email entity flows. This is work in progress and
the hunting and end user training experiences are planned to be tentatively
released in CY24Q1. Under URL list, it will show “QR code” as the Source in the
future indicating the URL came from a QR code.
0 Likes
Like
UrjaGandhi
Microsoft
Dec 14 2023 02:14 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 02:14 PM
@Brian Reid Thanks for the feedback. No specific configuration is needed. The QR
code protection applies to Exchange Online Protection (EOP) as well as Microsoft
Defender for Office 365 Plan 1 & Plan 2 licenses. We’ve updated the blog to
include this. Note: As mentioned in the blog already, URL detonation &
sandboxing applies only to Microsoft Defender for Office 365 Plan 1 & Plan 2
licenses. For services like OneDrive, Forms, this has been supported from a
while within the detonation chambers and no new updates have been necessary. If
customers are concerned about messages from such services, they should consider
Microsoft Defender for Office 365 plans.
0 Likes
Like
UrjaGandhi
Microsoft
Dec 14 2023 02:30 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 02:30 PM
@M_Wilkinson_ If the MX record of the organization does not point at Office 365,
then an ETR setting SCL to -1 will skip the protection. Please review the Secure
by default documentation specifically around the exceptions section (Secure by
default in Office 365 | Microsoft Learn) to better understand if High Confidence
phish verdicts would be applied to messages in your organization.
0 Likes
Like
UrjaGandhi
Microsoft
Dec 14 2023 02:38 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 02:38 PM
@michaelkennedy No specific configuration is needed. The QR code protection
applies to Exchange Online Protection (EOP) as well as Microsoft Defender for
Office 365 Plan 1 & Plan 2 licenses. We’ve updated the blog to include this.
Note: As mentioned in the blog already, URL detonation & sandboxing applies only
to Microsoft Defender for Office 365 Plan 1 & Plan 2 licenses.
No, currently we do not provide ability for a customer to block all QR codes.
Given the extensive use of QR codes for a variety of legitimate scenarios, this
may result in a high number of false positives. However, we have received this
request and will be considering it in our future roadmap. Thanks for the
feedback.
0 Likes
Like
rdelvalle
Copper Contributor
Dec 14 2023 03:08 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 14 2023 03:08 PM
@UrjaGandhi Where can I see the Sandbox environment and the URL detonations from
a QR code? If I plug in the URL into another tool that I will not mention here,
it passes the landing page of the URL and goes further. How do we access the
sandbox environment? Apologies as I am getting familiar with this.
0 Likes
Like
UrjaGandhi
Microsoft
Dec 15 2023 10:59 PM
* Mark as Read
* Mark as New
*
* Bookmark
*
* Permalink
* Print
*
* Report Inappropriate Content
Dec 15 2023 10:59 PM
@rdelvalle Great question! Unfortunately, sandboxing environment is our internal
detonation chamber and not accessible by customers. In the near future, there
will be ability for customers to view information about URLs coming from QR code
within the hunting and email entity flows. This is work in progress and
the hunting and end user training experiences are planned to be tentatively
released in CY24Q1. Under URL list, it will show “QR code” as the Source in the
future indicating the URL came from a QR code.
0 Likes
Like
You must be a registered user to add a comment. If you've already registered,
sign in. Otherwise, register and sign in.
* Comment
Co-Authors
UrjaGandhi
* SehrishKhan
* JoshCurtis
Version history
Last update:
Dec 14 2023 12:58 PM
Updated by:
UrjaGandhi
Labels
* Detection 12
* Phishing 9
* Prevention 20
* Threat Intelligence 4
SHARE
* Share to LinkedIn
* Share to Facebook
* Share to Twitter
* Share to Reddit
* Share to Email
Browse
Skip to Primary Navigation
What's new
* Surface Pro 9
* Surface Laptop 5
* Surface Studio 2+
* Surface Laptop Go 2
* Surface Laptop Studio
* Surface Duo 2
* Microsoft 365
* Windows 11 apps
Microsoft Store
* Account profile
* Download Center
* Microsoft Store support
* Returns
* Order tracking
* Virtual workshops and training
* Microsoft Store Promise
* Flexible Payments
Education
* Microsoft in education
* Devices for education
* Microsoft Teams for Education
* Microsoft 365 Education
* Education consultation appointment
* Educator training and development
* Deals for students and parents
* Azure for students
Business
* Microsoft Cloud
* Microsoft Security
* Dynamics 365
* Microsoft 365
* Microsoft Power Platform
* Microsoft Teams
* Microsoft Industry
* Small Business
Developer & IT
* Azure
* Developer Center
* Documentation
* Microsoft Learn
* Microsoft Tech Community
* Azure Marketplace
* AppSource
* Visual Studio
Company
* Careers
* About Microsoft
* Company news
* Privacy at Microsoft
* Investors
* Diversity and inclusion
* Accessibility
* Sustainability
California Consumer Privacy Act (CCPA) Opt-Out Icon Your Privacy Choices
* Sitemap
* Contact Microsoft
* Privacy
* Manage cookies
* Terms of use
* Trademarks
* Safety & eco
* About our ads
* © Microsoft 2024
Auto-suggest helps you quickly narrow down your search results by suggesting
possible matches as you type.
Auto-suggest helps you quickly narrow down your search results by suggesting
possible matches as you type.