Cybercriminals are increasingly using text-rendered QR codes to bypass email security tools designed to detect image-based phishing attacks, according to recent research highlighted by Kaspersky.
QR phishing, also known as quishing, tricks users into scanning a code displayed in an email.
The scan typically opens a phishing page on a smartphone, moving the victim away from a corporate browser, endpoint monitoring tools, and other desktop protections. The QR code also hides the destination URL until it is scanned.
Traditional quishing attacks commonly use QR codes as attached or embedded images. Secure Email Gateways (SEGs) can inspect those images, decode the QR code, extract the URL, and check it against threat-intelligence feeds, reputation services, redirects, and known phishing domains.
Email clients may also block remote images by default, preventing some QR codes from appearing at all.
Text-Based QR Phishing Bypasses
Instead of inserting a QR code as an image, attackers can build it directly inside an email using HTML markup, colored table cells, or text characters.
The email client renders the black-and-white grid as a fully scannable QR code, even though no image attachment, embedded bitmap, or <img> tag exists.
This creates a detection gap. Image-focused scanners and OCR systems generally begin by locating an image object.
If the email contains only HTML tables, layout elements, or Unicode-style block characters, there may be no image available for the gateway to extract and decode.
The approach can also work when remote images are disabled. A normal remote QR image may not display until the recipient clicks “show images.” However, a QR code made from HTML elements is part of the email body itself and can render immediately.
Researchers noted that real-world email rendering creates challenges for this technique. QR codes built with monospace Unicode block characters can become distorted by mobile email applications that change font size, spacing, or line height.
HTML tables are more reliable because table-cell dimensions are widely supported across Gmail, Outlook, and other email clients.
However, large HTML QR codes can create oversized messages. Gmail may clip emails that exceed roughly 102KB, potentially breaking a QR grid mid-render.
Using compressed HTML tables, such as merging same-colored cells with colspan, can significantly reduce message size and improve delivery reliability.
The key lesson for defenders is that “no image” does not mean “no QR code.” Security tools that only scan image attachments, embedded graphics, or remote image content may miss QR codes rendered through markup, phishu said.
Users should avoid scanning QR codes from unsolicited emails. If a message claims to come from Microsoft, a bank, HR, or a cloud service, recipients should open the service directly through a known URL or approved application rather than scanning the code.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
