Email Attacks Are Now Hiding Behind QR Codes

Microsoft's latest report reveals a surge in evasive email threats, including QR code phishing and attacks targeting collaboration tools like Microsoft Teams.

Microsoft Security has released a new report on the email threat landscape, highlighting a clear evolution in attacker tactics designed to bypass modern defenses. The analysis points to a significant rise in several sophisticated techniques, with QR code phishing, also known as “quishing,” emerging as a primary concern. The report also identifies other growing threats, including the use of CAPTCHA-gated phishing pages, business contact impersonation, and the expansion of attacks into collaboration platforms like Microsoft Teams. These findings suggest that threat actors are actively adapting their methods to circumvent the text-based and link-scanning technologies that form the backbone of most corporate email security systems. According to Microsoft, its threat intelligence systems detected approximately 7.3 billion email-based phishing threats in the last quarter alone, underscoring the massive scale of the problem facing organizations.

The effectiveness of these new methods lies in their ability to evade automated detection. QR code phishing, for example, works by embedding a malicious link within an image rather than in text. An email security gateway scanning for suspicious URLs will not see one, allowing the email to reach the user's inbox. The attack executes when the user scans the QR code with their smartphone, which opens the malicious link in their mobile browser. This action effectively moves the attack off the corporate-managed desktop and onto a personal or less-controlled mobile device, bypassing network-level security controls. Similarly, CAPTCHA-gated attacks present another layer of evasion. The initial link in the email leads to a page with a CAPTCHA challenge. Automated security tools and sandboxes often cannot solve these puzzles, so they are unable to analyze the final destination page where the credential theft or malware delivery actually occurs.

This trend is part of a broader cat-and-mouse game between attackers and defenders. As security solutions have become more adept at identifying known malicious domains, file attachments, and suspicious language, attackers have been forced to innovate. Using images like QR codes and multi-stage attacks that require human interaction (solving a CAPTCHA) are direct responses to automated defenses. The expansion into platforms like Microsoft Teams is another logical step in this evolution. Attackers follow users to where they work, communicate, and trust links shared by colleagues. By compromising one account, they can leverage the inherent trust within a collaboration environment to launch further attacks, making them appear more legitimate and increasing their chances of success. This represents a strategic shift from single-vector email attacks to more complex, multi-platform social engineering campaigns.

The key takeaway for IT leaders, CTOs, and security teams is that technology-only solutions are becoming insufficient. These evasive tactics are specifically engineered to slip past automated filters and land in front of an employee, making the human element the last line of defense. This reality necessitates a renewed and urgent focus on security awareness training. Employees must be educated to recognize the novel risks posed by unexpected QR codes in emails and to treat links in collaboration tools with the same skepticism as those in email. For security teams, it’s a signal to re-evaluate their defense-in-depth strategy. This includes exploring advanced threat protection that incorporates image analysis, strengthening mobile device management (MDM) policies, and enhancing monitoring to detect anomalous activity that might indicate a successful compromise originating from one of these evasive attacks.

These phishing techniques, especially QR code and CAPTCHA-gated attacks, are designed to evade automated security tools that rely on traditional URL scanning. This means existing defense-in-depth strategies may have significant gaps, forcing security engineers to re-evaluate threat detection models and email gateway configurations.

The evolution of phishing to bypass standard corporate defenses increases the risk of successful credential theft, data breaches, and ransomware. A single compromised employee account can lead to significant financial loss and operational disruption, making updated security training a critical business priority.