How Should Organizations Prevent Phishing in Teams, Calendars, QR Codes, and Collaboration Tools?

Phishing has expanded well beyond the email inbox. As attackers exploit Microsoft Teams, calendar invitations, QR codes, shared documents, and other everyday business tools, organizations need security controls and employee behaviors that work across the entire digital workplace.

Phishing has become remarkably good at keeping up with office technology. Give employees a new way to communicate, collaborate, share documents, or approve work, and someone will eventually discover how to use it to impersonate a colleague, steal credentials, or persuade an employee to do something spectacularly unwise. The technology changes, but the underlying opportunity remains familiar: convince someone that a fraudulent request belongs to the legitimate work they are already doing.

For years, organizations have invested heavily in email security and phishing awareness. Those investments remain essential, but employees now encounter potentially malicious requests through Microsoft Teams, Outlook calendars, shared documents, QR codes, help-desk conversations, and automated business notifications. An employee may receive a fraudulent meeting invitation in their calendar, encounter an impersonator in a collaboration channel, or scan a QR code that leads to a convincing Microsoft 365 login page.

The challenge is that these interactions rarely feel like traditional phishing. They arrive through familiar applications, use recognizable business conventions, and often appear in the middle of a legitimate task. Effective prevention requires organizations to understand how threats move across communication channels, where employees make consequential decisions, and which controls can interrupt an attack before it becomes an incident.

What is collaboration phishing, and how is it different from email phishing?

Collaboration phishing is a form of social engineering that uses workplace collaboration applications, shared content, meeting systems, or related notifications to deceive users into disclosing information, granting access, or performing unauthorized actions. It includes attacks delivered through platforms such as Microsoft Teams, Slack, shared document environments, calendar applications, and other tools employees use to coordinate work.

The distinction from conventional email phishing is primarily the environment in which the employee encounters the request. Traditional phishing often arrives as an email containing a malicious link, attachment, or instruction. Collaboration phishing can use many of the same techniques, but it presents them through interfaces associated with meetings, conversations, document sharing, and routine business activity.

For example, an employee may receive a Teams message that appears to come from an IT support representative. The message claims that an account problem requires immediate attention and directs the employee to a fraudulent authentication page. The employee may interpret the message differently from an unfamiliar email because it appears inside a collaboration environment regularly used by legitimate colleagues.

The important security question is whether the request is legitimate and authorized, regardless of which application delivers it. A familiar collaboration platform can establish where a message was received, but it does not automatically establish the trustworthiness of the person, content, or action associated with that message.

Why are attackers targeting collaboration tools instead of traditional email?

Attackers target collaboration tools because employees increasingly conduct important business activities through these systems, and the interfaces can create opportunities for convincing impersonation and fraudulent requests. The shift reflects the way enterprise communication has evolved, although email remains a major phishing channel and collaboration attacks frequently depend on email as part of their delivery.

Modern work involves constant movement between applications. Employees receive notifications, join meetings, review shared files, respond to chat messages, approve requests, and authenticate to connected services throughout the day. Each interaction creates an opportunity for an attacker to introduce deceptive information into an otherwise legitimate workflow.

Collaboration platforms also contain contextual cues that can make requests appear credible. A message may reference a project, a shared document, an upcoming meeting, or an internal support process. Attackers can exploit these details to make an interaction feel consistent with the recipient's responsibilities.

This creates a different challenge from teaching employees to identify a suspicious email. The employee may be focused on completing a task rather than evaluating the legitimacy of a communication, particularly when the request appears in an application they use frequently.

Organizations therefore need to examine the risks associated with the entire digital workplace rather than assuming that phishing prevention begins and ends at the email gateway.

How does Microsoft Teams phishing work?

Microsoft Teams phishing occurs when attackers use Teams messages, meeting-related content, invitations, or associated workflows to deceive employees into visiting malicious destinations, disclosing credentials, granting access, or following fraudulent instructions. The attacker may impersonate a colleague, support representative, external partner, or other trusted party.

The exact delivery mechanism depends on the attack and the organization's Teams configuration. Some campaigns may involve messages from external users, while others exploit compromised accounts or legitimate collaboration features to reach recipients.

A common scenario involves an attacker claiming to represent IT support. The employee receives a message describing an urgent account or device problem and is instructed to open a link, install software, or complete an authentication step. If the employee accepts the apparent authority of the message, the attacker may gain an opportunity to steal credentials or induce another unauthorized action.

Other attacks may use fraudulent meeting links, shared files, or messages that imitate established business conversations. The underlying deception often depends on the recipient assuming that a request received through Teams has already passed an appropriate level of organizational scrutiny.

Security teams should assess external access, guest access, identity protections, application permissions, and the handling of suspicious content within their Teams environment. Employees should also understand that a message appearing in Teams does not eliminate the need to verify unusual requests.

What is calendar invite phishing, and why is it a growing concern?

Calendar invite phishing uses meeting invitations, calendar event files, and scheduling notifications to direct recipients toward fraudulent websites or other unauthorized actions. Attackers may include deceptive meeting links, authentication instructions, or payment requests inside invitations that resemble legitimate business appointments.

In October 2026, Check Point reported a large Microsoft 365 phishing campaign involving more than 302,000 unique phishing emails reaching over 40,000 organizations. The attacks used familiar calendar formats and meeting-related content to direct recipients toward malicious destinations, including fraudulent Microsoft authentication pages.

The significance extends beyond the number of messages detected. Calendar invitations are ordinary business objects that employees process quickly, often while concentrating on scheduling rather than security. The attacker attempts to use the familiar appearance and expected actions of a meeting invitation to make a fraudulent request seem routine.

Calendar attacks can also create complications for technical remediation. Depending on platform behavior and configuration, malicious calendar objects may remain accessible after the originating email has been blocked or removed. Security teams should therefore examine how their email and calendar protections interact rather than assuming that message-level remediation always removes the associated risk.

For a detailed explanation of attack mechanics, Microsoft 365 protections, and employee guidance, see What Is Calendar Invite Phishing, and How Can Organizations Prevent It?.

What is QR code phishing, or quishing?

QR code phishing, commonly called quishing, is a phishing technique that uses a QR code to direct someone to a malicious website or other deceptive destination. The code may appear in an email, printed document, presentation, poster, shared file, or another communication that encourages the recipient to scan it with a mobile device.

QR codes are useful because they simplify navigation between physical and digital environments. Employees can scan a code to register for an event, access a document, authenticate to a service, or retrieve information without manually entering a website address. Attackers exploit that convenience by placing fraudulent destinations behind codes that appear to serve legitimate purposes.

A phishing email might contain a QR code claiming that the employee must verify their Microsoft 365 account. A printed notice might imitate an internal IT announcement and direct employees to scan a code to complete a security update. The code itself provides little visible information about the destination unless the scanning application or device displays a preview.

Quishing can also shift an interaction from a managed work computer to a personal mobile device. Depending on the organization's security architecture, this may change which protections, monitoring capabilities, and reporting mechanisms are available.

Organizations should teach employees to evaluate the source and purpose of QR codes, inspect destinations when possible, and avoid entering credentials into unfamiliar sites reached through unexpected scanning requests. Technical controls should also consider how malicious destinations are detected across devices and applications.

How do attackers use shared documents and cloud collaboration links for phishing?

Attackers can use shared document notifications, file-sharing invitations, and cloud collaboration links to persuade employees to open malicious destinations or disclose credentials. These attacks may imitate legitimate notifications from Microsoft OneDrive, SharePoint, Google Drive, or other business platforms.

The deception often relies on the employee's expectation that shared documents are a normal part of work. A recipient may receive a notification claiming that a colleague has shared an important file, updated a project document, or requested a review. Following the link may lead to a fraudulent authentication page or another malicious destination.

Some attacks use compromised legitimate accounts or services to make the notification more credible. Others imitate the appearance of familiar platforms without originating from those platforms at all.

The security implications depend on the specific mechanism. A malicious link that merely resembles a document-sharing notification presents a different technical challenge from a legitimate shared document containing deceptive instructions. Both can expose employees to social engineering, but the relevant controls may differ.

Organizations should examine external sharing permissions, application access, malicious-link protections, identity controls, and employee verification procedures. Security awareness should also explain how to recognize unexpected authentication requests associated with shared content.

How do phishing attacks exploit trusted business applications?

Phishing attacks exploit trusted business applications by placing deceptive requests inside workflows that employees associate with legitimate work. The attacker may imitate an authorized user, manipulate content, or use legitimate application functionality to create a convincing request.

This is particularly important because employees often use interface familiarity as a practical shortcut when interpreting information. A notification that resembles an established workflow may receive less scrutiny than an unfamiliar email, especially when the employee is concentrating on completing the task.

Consider a finance employee who receives a payment approval request through a familiar business system. The employee may recognize the interface, the approval format, and the type of transaction. If the request contains fraudulent supplier information or exceeds the requester's authority, the surrounding application does not automatically make the transaction legitimate.

The same principle applies to collaboration messages, calendar invitations, document-sharing notifications, and AI-generated workflow recommendations.

Organizations should distinguish between the legitimacy of the application and the legitimacy of the particular request. A trusted platform can still contain untrusted information, compromised identities, unauthorized instructions, or malicious links.

This distinction is central to effective verification behavior. Our guide to verification behavior in cybersecurity explains how employees can establish legitimacy before taking consequential actions.

What security controls help prevent phishing across collaboration platforms?

Preventing phishing across collaboration platforms requires layered technical and operational controls that address malicious content, compromised identities, unauthorized access, and the actions attackers attempt to induce.

The appropriate controls depend on the organization's technology environment, business processes, and risk exposure. A useful prevention strategy generally includes several complementary capabilities.

These controls should operate together rather than as isolated protections.

For example, an organization may successfully detect a malicious email but fail to remove an associated calendar event. It may deploy strong authentication while leaving a payment approval process vulnerable to impersonation. It may teach employees to report suspicious messages but provide no clear reporting mechanism inside the collaboration application where the threat appears.

A mature prevention strategy examines the complete sequence from delivery to potential compromise or fraud.

How should organizations secure Microsoft Teams against phishing?

Organizations should secure Microsoft Teams by combining appropriate external communication policies, identity protections, application governance, threat detection, and employee verification procedures.

Security teams should review how external users and guests can communicate with employees, how applications and integrations are authorized, and which controls are available for detecting suspicious links or content. These decisions should reflect legitimate collaboration needs rather than applying restrictions without considering operational consequences.

Identity security is particularly important because compromised accounts can make fraudulent requests more convincing. An attacker using a legitimate account may inherit contextual credibility that an unfamiliar external sender would not possess.

Organizations should also define verification procedures for sensitive requests received through Teams. An employee should not treat a chat message as sufficient authorization to disclose credentials, approve a payment, reset authentication methods, or grant privileged access.

The employee needs a practical way to confirm the request through an established process or independent channel.

Security teams should test their controls and reporting procedures against realistic scenarios, including external impersonation, compromised-account messaging, and fraudulent support requests.

The goal is to support legitimate collaboration while preventing a familiar communication channel from becoming an uncontrolled path to sensitive actions.

How should organizations protect employees from phishing through QR codes?

Organizations can reduce QR code phishing risk by combining destination protection, appropriate mobile security, employee guidance, and controls over sensitive authentication and business transactions.

The first consideration is where the QR code appears and what action it requests. A code printed on a public poster presents different risks from one embedded in an internal workflow or a document shared by a trusted colleague.

Employees should be encouraged to inspect the destination when their device provides a preview, avoid unexpected credential-entry requests, and use trusted application access methods for important services. They should also know how to report suspicious QR codes, including those encountered in physical locations.

Technical protections may include managed mobile device security, malicious website detection, browser protections, and phishing-resistant authentication. The available capabilities will vary depending on whether employees use managed devices, personal devices, or a combination of both.

Organizations should avoid relying exclusively on employees' ability to recognize a suspicious URL. A fraudulent destination may be designed to resemble a legitimate service, and the employee may not have sufficient information to distinguish it visually.

The more consequential the requested action, the more important it becomes to establish legitimacy through controls beyond the QR code itself.

How can organizations design verification procedures that work across channels?

Organizations should design verification procedures around the action being requested rather than the communication channel used to deliver it.

A request to change supplier banking information should require appropriate verification whether it arrives by email, Teams, telephone, or a supplier portal. A request to reset authentication methods should follow established identity-verification requirements regardless of whether the requester contacts the help desk through chat, a ticket, or a phone call.

This approach reduces the risk that an attacker can bypass a control simply by moving the request into a different application.

Effective procedures identify the consequential action, the evidence required to establish legitimacy, the person authorized to approve it, and the appropriate escalation path when the evidence is insufficient.

They should also be practical.

If an employee must navigate several systems, locate an obscure policy, and wait indefinitely for confirmation, the organization may unintentionally encourage workarounds. Verification needs to be accessible enough to become part of the normal workflow.

Our guide, How Should Organizations Design Verification Processes to Prevent Impersonation Fraud?, examines how to establish these controls in real business processes.

Why is cross-channel phishing a Human Risk Management problem?

Cross-channel phishing is a Human Risk Management problem because the success of an attack can depend on how employees interpret requests, recognize when verification is required, and perform the behaviors that support organizational controls.

The same employee may encounter a fraudulent request through several different interfaces. A suspicious email may be recognized immediately, while a similar request presented as a Teams message or calendar invitation may be processed through a more familiar routine.

That difference does not necessarily indicate that the employee lacks security knowledge. It may reflect the context in which the request appears, the expectations associated with the application, or the availability of appropriate verification procedures.

Human Risk Management needs to account for those conditions.

Organizations should understand which roles encounter particular threat scenarios, what competencies those employees require, which behaviors are expected, and how the surrounding workflow influences performance.

For example, a finance team may need to verify payment changes across email, supplier portals, and collaboration tools. A service desk may need to establish identity across telephone, chat, and ticketing systems. Employees using AI assistants may need to evaluate requests or recommendations generated through automated workflows.

These are related security challenges because they involve establishing legitimacy and authority before consequential actions.

Cybermaniacs' Human Risk Assessments and Baselines help organizations examine workforce competency, behavior, culture, and organizational context in relation to meaningful business risks.

How should cybersecurity awareness training address phishing beyond email?

Cybersecurity awareness training should address phishing beyond email by using realistic scenarios from the applications and workflows employees encounter in their roles.

Employees need to understand that malicious requests can arrive through collaboration messages, meeting invitations, shared documents, QR codes, and other familiar channels. However, simply adding more threat categories to a training presentation is unlikely to produce the strongest results.

The learning should focus on the decisions employees need to make.

An employee receiving an unexpected Microsoft 365 authentication request should know how to access the service through a trusted route. A finance employee receiving a payment change through Teams should understand that the established verification procedure still applies. A service desk analyst handling an urgent account recovery request should know how to establish identity before resetting authentication methods.

These examples teach transferable behaviors that remain useful even when attackers change their preferred delivery mechanisms.

Training should also reflect the pressures employees experience during actual work. Time constraints, apparent authority, familiar interfaces, and competing priorities can influence whether employees recognize and respond appropriately to suspicious requests.

Our guide, How Do Workplace Habits and Automatic Behaviors Increase Cybersecurity Risk?, explores why these conditions matter and how organizations can design more effective interventions.

Cybermaniacs' Cyber Learning Experience supports ongoing cybersecurity learning, while our Cybersecurity Content as a Service helps organizations communicate emerging threats through targeted campaigns and workforce engagement.

Should organizations simulate phishing in Teams, calendars, and collaboration tools?

Organizations should consider realistic cross-channel phishing exercises when those scenarios reflect meaningful risks in their environment and the exercises can be conducted safely and appropriately.

A conventional email simulation can provide useful evidence about how employees respond to particular email-based threats. It does not necessarily establish how the same employees would respond to a fraudulent Teams message, calendar invitation, QR code, or document-sharing request.

Different interfaces create different expectations and opportunities for verification.

A cross-channel assessment might evaluate whether employees recognize unexpected authentication requests, follow established verification procedures, avoid unauthorized actions, and report suspicious activity through the appropriate channels.

The exercise should be designed around specific learning and measurement objectives.

For example, a calendar phishing scenario could assess whether employees avoid entering credentials through an unfamiliar meeting link. A Teams impersonation scenario could assess whether employees independently verify an unusual request from apparent IT support. A finance workflow exercise could assess whether employees follow the required process when a supplier banking change is requested through an unexpected channel.

Organizations should interpret results carefully. A click, report, or approval provides evidence about a particular interaction, but it does not automatically establish the employee's underlying knowledge, intentions, or performance across all relevant situations.

Exercises should support learning and control improvement rather than serve as simplistic judgments about individual employees.

How can organizations measure cross-channel phishing resilience?

Organizations can measure cross-channel phishing resilience by evaluating technical control effectiveness, employee competency, observed security behaviors, and the performance of relevant business processes.

Technical measures may include malicious-content detection, blocked authentication attempts, suspicious sign-in activity, successful removal of malicious objects, and incident response effectiveness.

Human risk measures can examine whether employees recognize suspicious requests, perform independent verification, avoid unauthorized actions, and report potential attacks appropriately.

These measures should be interpreted within the context of the business process.

A finance employee who correctly verifies a supplier banking change has demonstrated a behavior directly relevant to preventing payment fraud. An employee who reports a suspicious meeting invitation has demonstrated a different behavior relevant to detecting and containing credential phishing.

Both may contribute to organizational resilience, but they should not be collapsed into an undifferentiated phishing score.

Organizations also need to evaluate the conditions influencing performance, including workflow design, available tools, management expectations, and clarity of procedures.

This is why effective Human Risk Management requires more than training completion statistics or aggregate phishing simulation click rates. The objective is to understand whether the workforce and surrounding controls can respond appropriately to the threats that matter for the organization.

Our guide, How Should Organizations Assess Human Risk in High-Risk Business Processes?, provides a practical framework for connecting scenarios, competencies, behaviors, and controls.

How should security teams respond to phishing across multiple collaboration channels?

Security teams should respond to cross-channel phishing by investigating the full sequence of attacker activity rather than limiting the investigation to the application where the threat was first detected.

An attack may begin with an email invitation, create a calendar event, direct an employee to a fraudulent authentication page, and result in suspicious account activity. Another may involve a compromised collaboration account used to send fraudulent requests to colleagues or external partners.

The investigation should identify the affected identities, applications, messages, content, destinations, and business actions.

Security teams may need to coordinate evidence from email security, collaboration platforms, identity providers, endpoint systems, and business applications. The exact sources will depend on the organization's environment and the incident.

Response procedures should distinguish between delivery, interaction, credential disclosure, unauthorized access, and subsequent actions.

An employee receiving a malicious message does not establish that the employee followed its instructions. Similarly, a suspicious link click does not necessarily establish credential theft or account compromise.

Appropriate remediation may include removing malicious content, securing affected accounts, revoking sessions, reviewing permissions, investigating unauthorized transactions, and notifying relevant stakeholders.

Employees should have a clear reporting route regardless of where they encounter the suspicious request. The organization should also be able to connect reports from different channels when they relate to the same campaign.

How will AI change phishing across collaboration platforms?

AI may increase the scale, adaptability, and apparent credibility of phishing attempts delivered through collaboration platforms. Attackers can use generative systems to produce convincing messages, imitate business communication styles, and tailor fraudulent requests to different roles or organizational contexts.

However, AI is not required for collaboration phishing to succeed. Many attacks rely on familiar interfaces, compromised identities, and ordinary social engineering techniques rather than sophisticated generated content.

The larger concern is how AI-enabled communication and automation may change the environment in which employees encounter and evaluate requests.

As organizations introduce AI assistants and agents into collaboration workflows, employees may receive automated summaries, recommendations, approval requests, and task notifications alongside ordinary human communications.

Some of those interactions may involve consequential decisions or delegated authority.

Organizations will need to establish how employees verify the legitimacy of requests, understand the authority of automated systems, and recognize when intervention is required.

Cybermaniacs' AI Enablement & Culture Management (AIECM) and Agent Risk & Control (ARC) work addresses the human competencies, behaviors, and oversight requirements associated with AI-enabled operations.

The broader principle remains consistent: the apparent familiarity of an interface or the apparent intelligence of a system does not establish that a requested action is appropriate or authorized.

What should CISOs prioritize to reduce phishing risk across the digital workplace?

CISOs should prioritize a coordinated approach that connects identity security, collaboration platform controls, business process verification, workforce competency, and incident response.

The starting point is understanding where consequential business activities occur and how employees receive the information that prompts those activities.

For some organizations, the highest-risk scenarios may involve financial approvals and supplier changes. Others may be particularly exposed to help-desk impersonation, privileged access requests, sensitive document sharing, or external collaboration with customers and partners.

The security program should identify the controls that protect those activities and determine whether those controls remain effective when requests arrive through different channels.

Employees should receive learning and guidance that reflect their actual responsibilities. Security teams should measure whether the intended behaviors occur in relevant scenarios, while also examining whether organizational processes support those behaviors.

This approach is more sustainable than continually expanding a list of suspicious communication formats.

Attackers will continue to experiment with new applications, interfaces, and delivery mechanisms. Organizations need defenses that can adapt without requiring employees to memorize an entirely new set of warning signs every time a different platform becomes popular.

Phishing prevention needs to follow the work

The modern workplace is a collection of interconnected communication, collaboration, and business systems. Employees move between those environments throughout the day, often performing routine actions with little reason to question the surrounding technology.

Attackers understand this and increasingly exploit the expectations associated with familiar applications.

A fraudulent Teams message, malicious calendar invitation, deceptive QR code, or compromised document-sharing notification may look different from a traditional phishing email. Each can nevertheless lead toward the same consequential outcomes: unauthorized access, disclosure of information, fraudulent payments, or compromised business processes.

Effective prevention requires organizations to protect the applications employees use, establish verification and authorization controls around important actions, and develop the competencies and behaviors needed to recognize when an ordinary workflow has become a security decision.

That is the practical value of approaching phishing as a Human Risk Management problem rather than an endless collection of suspicious messages.

The attackers are following the work. Our defenses need to follow it too.

Frequently Asked Questions

What is collaboration phishing?

Collaboration phishing is a social engineering attack delivered through workplace collaboration applications, shared content, meeting systems, or related notifications. Attackers use these environments to impersonate trusted parties, direct employees toward malicious destinations, or persuade them to perform unauthorized actions.

Can Microsoft Teams be used for phishing attacks?

Yes. Attackers can use Teams messages, meeting-related content, compromised accounts, or other collaboration features to deliver fraudulent requests. Organizations should combine identity protections, appropriate external communication policies, threat detection, and verification procedures for sensitive actions.

What is QR code phishing?

QR code phishing, also called quishing, uses QR codes to direct recipients toward malicious websites or other deceptive destinations. Attackers may place fraudulent codes in emails, documents, printed materials, or business notifications to encourage credential disclosure or other unauthorized actions.

How can organizations prevent phishing outside email?

Organizations can reduce phishing outside email through layered identity security, collaboration platform protections, malicious-link detection, business process verification, role-based employee training, and incident response procedures that address threats across applications.

Should companies conduct phishing simulations in Teams and calendars?

Companies can use realistic Teams and calendar phishing exercises when the scenarios reflect meaningful organizational risks and the exercises are conducted safely. Assessments should evaluate relevant behaviors such as verification, appropriate authentication, and reporting rather than relying exclusively on click rates.

How should organizations measure cross-channel phishing risk?

Organizations should evaluate technical control effectiveness, employee competency, observed verification and reporting behaviors, and the performance of relevant business processes. Results should be interpreted in context rather than combined into a single generic phishing score.