Loading story…
Threat actors have launched a phishing campaign that leverages a novel technique to evade email security controls by rendering QR codes using HTML tables instead of traditional image files. The QR codes are constructed from hundreds of small table cells, each styled with black or white backgrounds to mimic the appearance of a standard QR code, but without embedding an actual image. This approach allows the QR code to be scanned by mobile devices while bypassing many email security gateways and QR inspection engines, which typically focus on detecting image-based QR codes. The phishing emails are minimalistic, containing only a short lure and a single, compressed QR code block that encourages recipients to scan it.
The QR codes in these campaigns redirect users to malicious subdomains, often crafted to appear legitimate by incorporating the recipient's own domain name in the URL path. Security researchers observed that this technique was actively used in phishing messages sent between December 22 and December 26, and noted that the HTML-based QR code structure is not new but remains relatively unknown and effective at evading detection. The use of HTML tables for QR code rendering highlights a blind spot in current email security solutions and demonstrates the ongoing evolution of phishing tactics to circumvent established defenses.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-01-07, the SANS Internet Storm Center published analysis of the campaign, highlighting that HTML table-based QR codes can bypass security tools focused on image-based QR detection. The reporting recommended improved technical controls, including analysis of dense HTML tables, along with continued user awareness training.
Between 2025-12-22 and 2025-12-26, attackers ran a phishing campaign that rendered QR codes as HTML tables instead of image files inside emails. The QR codes directed recipients to malicious lidoustoo[.]click subdomains, often with URLs tailored to the target's email address or domain to appear more legitimate.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are building scannable QR codes from colored HTML table cells, rather than embedded images or attachments, to bypass email controls that extract and inspect conventional QR-code images. The emails can render a valid code even where remote images are disabled, directing recipients—often from a managed workstation to a mobile device—to credential-harvesting, session-theft, payment-fraud, or malware-delivery sites. The technique, identified by PhishU Framework, exploits gaps in defenses that do not render and visually inspect full email content. Organizations should detect QR-like visual patterns and unusually dense HTML markup, decode and assess resulting destinations, maintain remote-image blocking, apply post-delivery link protection, and test controls through authorized phishing simulations. HTML-email rendering differs across clients; reported Unicode block-character QR variants have displayed unreliably in Gmail mobile, while table-cell implementations are intended to provide more consistent rendering.
Sep 3, 2026
Threat actors are increasingly adopting sophisticated email phishing techniques that leverage both established and novel methods to bypass security controls and deceive users. One prominent trend is the use of PDF attachments in phishing emails, where attackers embed QR codes within the PDF files. This tactic encourages recipients to scan the QR code with their mobile devices, which often lack the robust security protections of corporate endpoints, thereby increasing the likelihood of successful credential theft or malware installation. In addition to QR codes, attackers are also distributing password-protected PDF attachments. The passwords are either included in the email or sent separately, which not only complicates automated scanning by security solutions but also lends an air of legitimacy to the communication, making recipients more likely to trust and open the files. These methods represent a resurgence and refinement of older phishing tactics, demonstrating the adaptability of threat actors in response to evolving security measures. Another significant development is the deployment of SVG image attachments as phishing lures, as seen in the Tykit phishing kit. This kit, identified as part of a phishing-as-a-service (PhaaS) operation, uses SVG files that mimic secure document viewers or prompt users to enter information, such as the last four digits of their phone number, under the guise of accessing secure content. The SVG files contain embedded JavaScript that redirects victims through a series of intermediary pages, ultimately leading to a fake Microsoft 365 login page designed to harvest credentials. The infrastructure supporting these attacks is highly organized, with command-and-control (C2) servers identified by unique URL patterns and attack flows that include adversary-in-the-middle (AitM) techniques to intercept and replay stolen credentials. The Tykit campaign has targeted hundreds of victims across multiple sectors, including finance, IT, government, professional services, and construction, with a notable concentration in the United States, Canada, and Southeast Asia. Activity associated with this campaign peaked in the latter half of 2025, indicating a surge in the adoption of these advanced phishing methods. The use of both PDF and SVG attachments in phishing campaigns highlights the ongoing arms race between attackers and defenders, as threat actors continuously refine their techniques to evade detection and exploit user trust. Security teams are challenged to adapt their defenses to account for encrypted attachments, QR code-based lures, and sophisticated image-based phishing kits. The prevalence of phishing-as-a-service offerings further lowers the barrier to entry for cybercriminals, enabling widespread and coordinated attacks. Organizations are urged to enhance user awareness, implement advanced email filtering, and monitor for emerging phishing tactics that leverage non-traditional attachment types and multi-stage attack chains. The evolving landscape of email phishing underscores the need for a multi-layered security approach that addresses both technical and human vulnerabilities.
Jun 29, 2026
Cybercriminals are increasingly using **HTML attachments** in phishing emails to evade detection and steal credentials, embedding malicious logic directly in attached files instead of placing suspicious links in the message body. The attachments commonly use JavaScript to redirect victims to fraudulent login pages or to display a complete phishing page locally inside the browser, making the email appear less obviously malicious to both users and some security controls. Researchers found that attackers also obfuscate these attachments to hinder static analysis, including hiding phishing URLs, concealing entire scripts, and using deprecated JavaScript functions such as `unescape()` to decode and render phishing content at runtime. Kaspersky reported detecting nearly **2 million** emails carrying malicious HTML attachments in the first four months of 2022, including **851,328** blocked in March alone, underscoring how effective and persistent the technique remains for credential-harvesting campaigns.
Aug 15, 2026