Hackers Bypass Email Security with Image-less QR Codes
Attackers are embedding QR codes directly into email markup, circumventing security tools that rely on image file inspection and redirecting users to phishing sites.
Cybercriminals have developed a novel technique to bypass email security filters by embedding QR codes directly within the HTML markup of emails, rather than as traditional image files. This method allows the email client to render a scannable QR code, which can then lead unsuspecting recipients to phishing websites designed to steal credentials or deliver malware. The tactic is particularly effective against security solutions that are configured to inspect only image objects within an email, as this new approach hides the QR code within the email's structure.
Traditional QR code phishing, often referred to as 'quishing,' typically involves attaching an image file containing the QR code or embedding it directly into the email body as a visual element. Security gateways can often extract these image files, decode the embedded links, and analyze them for malicious intent before delivery. However, the new imageless QR code technique circumvents this by constructing the QR pattern using HTML tables or text-like block characters. When rendered by an email client, these elements form a valid QR code, but an image-only scanner might only see styling instructions and text, failing to identify the embedded malicious link.
This evolving attack vector highlights a significant shift in threat actor tactics, adapting to improvements in email gateway defenses. By removing the expected image object, attackers create a blind spot for many security tools. Furthermore, this method can bypass defenses that block remote images, as the QR code is generated locally by the email client based on the HTML content. The PhishU Framework, which identified the technique, noted that while it circumvents image-based detection, defenses that perform visual rendering and analysis of the entire message can still detect these codes.
The impact of successful imageless QR code phishing can be severe. Once a user scans the QR code with their mobile device, they are directed to a malicious website. These sites can be designed to harvest sensitive information such as login credentials, session tokens, payment details, or even initiate the download of harmful software. The redirection to a mobile device also presents a challenge, as it moves the user away from potentially more secure work computers and into an environment where security controls might be less robust or less visible to the user.
Security professionals are advised to update their defenses to account for this new threat. The central recommendation is to implement mechanisms that visually render suspicious HTML content and then scan the resulting visual output for QR patterns. Analyzing any recovered destination URLs before allowing the email to reach the user's inbox is crucial. Detection rules can also be enhanced to look for unusual patterns in HTML, such as dense grids of small, alternating cells or blocks of characters arranged in specific fixed-width formats, which might indicate a dynamically generated QR code.
While retaining remote image blocking is still beneficial, it should not be the sole defense against quishing. Organizations should regularly test their email security solutions with authorized simulations to ensure they can detect these markup-generated QR codes. Post-delivery link protection should also be reviewed. For end-users, the most effective defense remains behavioral: exercising caution with unsolicited QR codes, verifying requests through known channels, inspecting decoded addresses before opening, and utilizing phishing-resistant authentication methods whenever possible.
This development underscores the need for a layered approach to email security that focuses on the ultimate behavior and content of a message, rather than just its constituent parts. As attackers continue to innovate, security strategies must evolve to analyze what a message *does* and how it appears to the end-user, ensuring that even visually rendered elements are scrutinized for malicious intent. User awareness training remains a critical component in mitigating the risk of these evolving phishing techniques.
This new report from ESET indicates that the 'quishing' tactic, where attackers embed malicious URLs within QR codes in phishing emails, has reached record levels in the first half of 2026. Approximately 11% of phishing emails detected by ESET during this period utilized QR codes, with the United States, Spain, and Mexico being the most targeted regions. The tactic exploits user familiarity with QR codes and can lead to the compromise of sensitive work and personal accounts, extending beyond a single stolen password.