Microsoft Teams phishing attack alerts coming to everyone next month

Microsoft is rolling out a default-on brand impersonation protection feature for Teams by mid-February 2025 that warns users during the Accept/Block flow on first-contact external messages deemed high-risk, requires message previewing before acceptance, and logs detections for admin review. The update targets phishing tactics leveraged by various threat actors, including state-sponsored groups like Midnight Blizzard, and recommends admins disable external access if not needed or allow-list specific domains when necessary.