QR-code phishing bypasses email scanners

Published September 3, 2026

Scammers are building QR codes out of plain HTML text and table cells instead of images, so email security tools that only scan pictures never see them. The email still shows a scannable QR code that leads to a fake login page designed to steal passwords.

Report priority
Medium
Targets
Secure Email Gateways+2 more

How it works

  • An email arrives with no image attachment at all.
  • Its body contains an HTML table with hundreds of tiny colored cells, or blocks of text characters, arranged into the pattern of a QR code, which the email app renders as a normal-looking scannable code even though no picture file exists to scan.

What to do

This is a phishing technique, not a product flaw, so treat any email asking you to scan a QR code to open a document, especially one claiming to be a DocuSign or partner document, as suspicious even if no image is attached.

Do not scan QR codes from unexpected emails, verify document requests through a separate known channel, and organizations should ask their email security vendor whether their filters inspect HTML tables and text-rendered grids, not just image attachments, for QR patterns.

Technical details

Affected software: Secure Email Gateways, Gmail, Outlook

An attacker sends an email that looks like it comes from a business partner, asking the recipient to scan a code to view a confidential document. The QR code in the email is not a picture but rows of tiny colored table cells arranged to form the code, so the email security filter sees only ordinary text and lets it through. The recipient scans it with their phone, and it opens a fake login page that harvests their password.

Attackers are constructing QR code matrices directly from HTML markup, either as a of colored cells or as monospace Unicode/ASCII block characters, rather than as an or embedded bitmap. Because Secure Email Gateways typically trigger QR/OCR analysis only after detecting an image object, these markup-rendered codes bypass that pipeline entirely while still rendering as a scannable code in the recipient's mail client. Table-based rendering is more reliable across clients like Gmail and Outlook than text-character rendering, which can be distorted by font and spacing changes. A documented Internet Storm Center campaign sent between December 22 and 26 used this technique with personalized tracking subdomains under lidoustoo.click, embedding recipient email addresses in the URL path.

References

View Original Source