“The threat actors use QR codes embedded in images to bypass email security tools that scan a message for known malicious links, allowing the phishing messages to reach the target’s inbox.”
Of the roughly 1,000 emails Cofense tied to this campaign, 29% hit one large US energy company. The lure was a Microsoft 365 account update with a QR code in a PNG or PDF. The redirects ran through Bing, Salesforce and Cloudflare, so the link scanner saw trusted names. Enterprises bought email filters that read links. Attackers just put the link in a picture and moved the click to an unmanaged phone.