Reported by 2 outlets

Timeline

1. original reporting

   Text-Based QR Phishing Bypasses Email Security and Image Scanners

   cyberpress.org · 40d ago · September 3rd, 2026

   Cybercriminals are increasingly using text-rendered QR codes to bypass email security tools designed to detect image-based phishing attacks, according to recent research highlighted by Kaspersky. QR phishing, also known as quishing, tricks users into scanning a code displayed in an email. The scan typically opens a phishing page on a smartphone, moving the victim away from a corporate browser, endpoint monitoring tools, and other desktop protections. The QR code also hides the destination URL until it is scanned. Traditional quishing attacks commonly use QR codes as attached or embedded images. Secure Email Gateways (SEGs) can inspect those images, decode the QR code, extract the URL, and check it against threat-intelligence feeds, reputation services, redirects, and known phishing domains. Email clients may also block remote images by default, preventing some QR codes from appearing at all. Text-Based QR Phishing Bypasses Instead of inserting a QR code as an image, attackers can build it directly inside an email using HTML markup, colored table cells, or text characters. The email client renders the black-and-white grid as a fully scannable QR code, even though no image attachment, embedded bitmap, or tag exists. This creates a detection gap. Image-focused scanners and OCR systems generally begin by locating an image object. A text-rendered QR shown in a laptop inbox and scanned from a phone. There is no image object anywhere in the message, but the code reads normally (Sour

2. update from cyberpress.org

   QR Phishing Bypasses Email URL Scanners by Encoding Malicious Links Inside Images

   cyberpress.org · 40d ago · September 3rd, 2026

   QR-code phishing, also known as quishing, is becoming a major email security concern as attackers hide malicious links inside images instead of placing them directly in message text. Traditional email security tools often inspect URLs in the email body, sender reputation, attachments, and known malicious domains. However, a QR code is an image containing encoded data. When the harmful URL is embedded inside that image, basic URL-scanning systems may not detect it before the email reaches a user’s inbox. The attacker’s goal is simple: persuade a recipient to scan the QR code with a smartphone. The victim is then sent to a phishing page that can steal Microsoft 365, banking, VPN, or other corporate credentials. Since the scanning and browsing activity happens on a personal or mobile device, it may also occur outside the organization’s protected network and security controls. ESET’s H1 2026 Threat Report shows that QRCode/Phishing detections ranked among the top email threats. QRCode/Phishing accounted for 4.1% of the top 10 email-threat detections during the first half of 2026. This places it alongside common threats such as HTML/Phishing.Agent, malicious Office documents, JavaScript downloaders, and PDF-based phishing. QR Phishing Evades Scanners In a typical campaign, attackers send an email pretending to be from an IT team, HR department, cloud provider, delivery company, bank, or payroll service.

3. update from gbhackers.com

   HTML-Rendered QR Phishing Evades Image Extraction and OCR-Based Email Scanning

   gbhackers.com · 40d ago · September 3rd, 2026

   Threat actors are now rendering scannable QR codes directly from HTML tables or text within email bodies, leaving no image attachment, embedded bitmap, or element for traditional email scanners to inspect. The technique targets a structural blind spot in Secure Email Gateways (SEGs). […] The post HTML-Rendered QR Phishing Evades Image Extraction and OCR-Based Email Scanning appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .