Hackers are using QR codes without image files to slip past email defenses. The tactic turns email markup into a scannable code, routing recipients to a phishing page while depriving many security tools of the image object they expect to inspect.
QR phishing moves victims from a monitored work computer to a mobile device. A scan can conceal the destination until the phone opens it, and attackers may use the landing page to steal sign-in details, session data, payment information, or deliver a harmful download.
Analysts from PhishU Framework identified the technique after examining a form of quishing that builds a QR pattern directly in an email body. It reflects the shift in which attackers alter delivery formats as mail gateways improve at detecting known lures.
PhishU Framework said in a report shared with Cyber Security News (CSN) that the approach can display even when remote images are blocked.
The report describes a gap, not an unstoppable attack: defenses that render the entire message visually and inspect the result can still identify the code.
Hackers Use QR Codes With No Images
Traditional email QR scams include a bitmap in an attachment or message body. A secure email gateway can extract that image, decode the embedded link, and examine redirects before deciding whether the email poses a risk.
The new method removes that starting point. They can arrange black and white squares with HTML tables or text-like block characters, so the mail client draws a QR code as part of its layout.
A phone camera sees the same valid pattern, but an image-only scanner may see only text and styling instructions. That distinction explains why the technique can sidestep controls built for traditional attachment and image-based scams.
A imageless QR-code phishing campaign showed how dense HTML tables can create a working code that redirects victims to hostile websites.
The attack exploits a familiar human weakness. An email that appears to be an invoice, shared document, security alert, or account notice can pressure a recipient to scan rather than examine a clickable link.
Recent email phishing threat figures show QR lures remain a material part of phishing activity as criminals adapt attachments and delivery methods.
Defenders Need Visual Inspection
The central lesson for security teams is to stop treating the absence of an image as proof that no QR code is present.
Mail protection should render suspicious HTML as a recipient would see it, scan the visual result for QR patterns, and inspect any recovered destination before allowing the message through.
Detection rules can also look for unusually dense grids of tiny alternating cells, repeated color attributes, or blocks of characters arranged in a fixed-width pattern.
These signals are not automatically malicious, but they give analysts a reason to review an email whose design does not match normal business communication.
Administrators should retain remote-image blocking, but should not rely on it as a complete quishing defense. They should test their email path using authorized simulations, confirm whether markup-built codes are detected, and review link protection after delivery.
Guidance on QR-code attack response guidance also stresses previewing decoded links and avoiding sign-in or payment details on a site reached from an unexpected code.
For employees, the safest response is behavioral rather than technical: do not scan an unsolicited QR code just because an email says it is urgent.
Verify the request through a known channel, inspect the decoded address before opening it, and use phishing-resistant sign-in methods where possible.
The risk becomes sharper when attackers use a trusted mailbox, as credential theft through compromised mailboxes can make a lure appear legitimate.
This development is another reminder that email security must evaluate what a message does, not merely what files it contains.
QR codes assembled from markup are still visible to people, so layered filtering, careful inspection, and user awareness remain the most reliable way to reduce the chance that a scan becomes an account compromise.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
The post Hackers Use QR Codes With No Images to Bypass Email Security appeared first on Cyber Security News.