Loading story…
Attackers are building scannable QR codes from colored HTML table cells, rather than embedded images or attachments, to bypass email controls that extract and inspect conventional QR-code images. The emails can render a valid code even where remote images are disabled, directing recipients—often from a managed workstation to a mobile device—to credential-harvesting, session-theft, payment-fraud, or malware-delivery sites.
The technique, identified by PhishU Framework, exploits gaps in defenses that do not render and visually inspect full email content. Organizations should detect QR-like visual patterns and unusually dense HTML markup, decode and assess resulting destinations, maintain remote-image blocking, apply post-delivery link protection, and test controls through authorized phishing simulations. HTML-email rendering differs across clients; reported Unicode block-character QR variants have displayed unreliably in Gmail mobile, while table-cell implementations are intended to provide more consistent rendering.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
The FBI warned that North Korea-aligned Kimsuky used malicious QR codes in spearphishing campaigns targeting organizations in the United States.
An attempted version of the technique using Unicode block characters reportedly rendered unreliably in Gmail mobile, where character stretching prevented consistent QR-code construction. The HTML-table method was discussed as a more viable approach despite the challenges of inconsistent HTML-email rendering across clients.
PhishU Framework identified a quishing method that constructs scannable QR codes from colored HTML-table cells or text-like markup in email bodies, rather than embedded image files. The technique can evade controls that only extract and inspect conventional QR-code images and can direct recipients to phishing sites or other hostile destinations.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have launched a phishing campaign that leverages a novel technique to evade email security controls by rendering QR codes using HTML tables instead of traditional image files. The QR codes are constructed from hundreds of small table cells, each styled with black or white backgrounds to mimic the appearance of a standard QR code, but without embedding an actual image. This approach allows the QR code to be scanned by mobile devices while bypassing many email security gateways and QR inspection engines, which typically focus on detecting image-based QR codes. The phishing emails are minimalistic, containing only a short lure and a single, compressed QR code block that encourages recipients to scan it. The QR codes in these campaigns redirect users to malicious subdomains, often crafted to appear legitimate by incorporating the recipient's own domain name in the URL path. Security researchers observed that this technique was actively used in phishing messages sent between December 22 and December 26, and noted that the HTML-based QR code structure is not new but remains relatively unknown and effective at evading detection. The use of HTML tables for QR code rendering highlights a blind spot in current email security solutions and demonstrates the ongoing evolution of phishing tactics to circumvent established defenses.
Jun 29, 2026Microsoft said attackers are increasingly using **QR-code phishing** to steal credentials, with the company analyzing **8.3 billion** email-based phishing threats in Q1 2026 and recording a **146% increase** in quishing activity. Researchers said more than **35,000 users** across roughly **13,000 organizations** were targeted through emails, PDFs, and fake CAPTCHA pages carrying malicious QR codes that redirected victims through multiple sites to counterfeit login portals. Microsoft also reported a **336% surge** in QR codes embedded directly in emails in March, alongside continued business email compromise lures and phishing kits such as **Tycoon2FA**, which it disrupted with Europol before operators began rebuilding infrastructure and shifting toward `.RU` domains. The warning follows a separate Microsoft 365 security incident in which faulty heuristic anti-phishing rules in Exchange Online and Teams wrongly flagged legitimate content as malicious. The incident, tracked as **`EX1227432`**, caused valid emails to be quarantined, links to be blocked, **Zero-hour Auto Purge (ZAP)** actions to trigger incorrectly, and false **Microsoft XDR** alerts to be sent after a logic error misclassified legitimate URLs as phishing links. Microsoft said the outage was prolonged by bugs in related signature and rollback systems, underscoring how both attacker evasion and defensive misfires can disrupt cloud email security and credential protection efforts.
Jun 29, 2026
Threat actors are increasingly adopting sophisticated email phishing techniques that leverage both established and novel methods to bypass security controls and deceive users. One prominent trend is the use of PDF attachments in phishing emails, where attackers embed QR codes within the PDF files. This tactic encourages recipients to scan the QR code with their mobile devices, which often lack the robust security protections of corporate endpoints, thereby increasing the likelihood of successful credential theft or malware installation. In addition to QR codes, attackers are also distributing password-protected PDF attachments. The passwords are either included in the email or sent separately, which not only complicates automated scanning by security solutions but also lends an air of legitimacy to the communication, making recipients more likely to trust and open the files. These methods represent a resurgence and refinement of older phishing tactics, demonstrating the adaptability of threat actors in response to evolving security measures. Another significant development is the deployment of SVG image attachments as phishing lures, as seen in the Tykit phishing kit. This kit, identified as part of a phishing-as-a-service (PhaaS) operation, uses SVG files that mimic secure document viewers or prompt users to enter information, such as the last four digits of their phone number, under the guise of accessing secure content. The SVG files contain embedded JavaScript that redirects victims through a series of intermediary pages, ultimately leading to a fake Microsoft 365 login page designed to harvest credentials. The infrastructure supporting these attacks is highly organized, with command-and-control (C2) servers identified by unique URL patterns and attack flows that include adversary-in-the-middle (AitM) techniques to intercept and replay stolen credentials. The Tykit campaign has targeted hundreds of victims across multiple sectors, including finance, IT, government, professional services, and construction, with a notable concentration in the United States, Canada, and Southeast Asia. Activity associated with this campaign peaked in the latter half of 2025, indicating a surge in the adoption of these advanced phishing methods. The use of both PDF and SVG attachments in phishing campaigns highlights the ongoing arms race between attackers and defenders, as threat actors continuously refine their techniques to evade detection and exploit user trust. Security teams are challenged to adapt their defenses to account for encrypted attachments, QR code-based lures, and sophisticated image-based phishing kits. The prevalence of phishing-as-a-service offerings further lowers the barrier to entry for cybercriminals, enabling widespread and coordinated attacks. Organizations are urged to enhance user awareness, implement advanced email filtering, and monitor for emerging phishing tactics that leverage non-traditional attachment types and multi-stage attack chains. The evolving landscape of email phishing underscores the need for a multi-layered security approach that addresses both technical and human vulnerabilities.
Jun 29, 2026