Microsoft reports more than 145 million QR-code phishing attacks
Microsoft’s 2026 Digital Defense Report, released on 1 October, highlights the scale of QR-code phishing: Microsoft Defender for Office 365 detected more than 145 million such attacks between July 2025 and June 2026.
That figure comes from Microsoft’s wider security telemetry and is not a count of attacks on schools. The report also says that 89–95% of email phishing attachments led to a credential theft attempt, underlining the continuing importance of protecting accounts.
Microsoft describes attackers using automation and AI while continuing to exploit familiar weaknesses, including compromised identities, reused credentials and excessive permissions. It also points to security risks around AI agents and connected applications.
For schools, the relevance is practical. QR codes are common in communications, events and classroom resources, but familiarity does not establish that a destination is safe. Staff awareness, trusted routes to school systems, prompt reporting of unexpected login requests and careful review of account permissions all deserve attention.
Comments