QR code phishing bypasses email filters

Published August 31, 2026

Attackers are building QR codes out of text and table formatting inside an email instead of using an image. That lets the code slip past filters that only scan pictures, sending victims to a phishing page when they scan it with their phone.

Report priority
Medium

How it works

  • Attackers arrange black and white blocks using HTML tables or text characters so the email itself draws a QR pattern, instead of embedding it as a picture.
  • A phone camera reads it as a normal code, but scanners built to inspect images never see anything to check.

What to do

Ask your email security team whether the gateway renders messages visually and scans for QR patterns built from HTML/text, not just image attachments.

Keep remote-image blocking but don't rely on it alone, run authorized phishing simulations using text-built QR codes to test detection, and train staff to preview the decoded link before opening it and never enter credentials after scanning an unexpected code.

Technical details

The PhishU Framework report describes quishing emails that render a QR code using dense HTML tables or block characters rather than an embedded bitmap. Because many secure email gateways detect QR phishing by extracting an image object and decoding it, a markup-rendered code has no image for that pipeline to inspect, letting it pass filters that would catch a traditional attachment-based lure. The researchers recommend gateways render suspect HTML as a human would see it and scan that rendered output for QR patterns, plus flag unusually dense grids of alternating cells or fixed-width character blocks as review triggers.

References

View Original Source