How Microsoft Defender for Office 365 innovated to address QR code phishing attacks

Microsoft reports a rapid rise in QR code phishing campaigns that use URL redirection, minimal text, brand impersonation, and AI to scale attacks; the company observed large volumes (peaked at ~3 million daily attempts, reduced to ~200k/day after mitigations) and describes Defender for Office 365 enhancements—QR URL extraction, advanced image processing, cross-product hunting and remediation, and attack-simulation training—to detect and disrupt these campaigns.