Listen to this Post
Introduction: When QR Codes Lose Their Images
QR codes have quietly become one of the most trusted shortcuts in modern digital life. From logging into services to confirming payments, users are trained to scan first and question later. Threat actors understand this habit well. While security vendors have invested heavily in detecting QR codes embedded as images in emails, attackers are now shifting tactics. A recent phishing campaign demonstrates how QR codes can be rendered without images at all—using nothing more than HTML tables—effectively slipping past defenses designed for a different threat model.
Background: QR Codes as a Familiar Attack Vector
Malicious QR codes are not a new invention in the phishing ecosystem. Attackers have long relied on them to redirect victims to credential-harvesting pages or malware-hosting sites. The logic is simple: scanning a QR code feels safer and more deliberate than clicking a suspicious link. As QR-based phishing, often referred to as “quishing,” became more widespread, email security platforms adapted by scanning images for QR patterns and extracting embedded URLs for analysis.
Defensive Progress Forces Attacker Adaptation
As QR code detection improved, the success rate of traditional image-based QR phishing declined. Security gateways learned to recognize QR code images, decode their contents, and block malicious destinations before they ever reached the inbox. Predictably, this pushed threat actors to experiment with alternative representations that exploit blind spots in existing detection logic.
Campaign Overview: A Subtle but Effective Technique
Between December 22 and December 26, a small but telling phishing campaign surfaced that showcased one such workaround. The emails were minimalistic, containing only a few lines of text and what appeared to be a slightly distorted QR code. At first glance, nothing seemed particularly unusual. The messages looked clean, restrained, and carefully formatted to avoid drawing suspicion.
The Illusion: QR Codes Without Images
The most important detail was invisible to the casual observer. The QR code was not an image file at all. Instead, it was constructed entirely using an HTML table. Each cell in the table was assigned a black or white background color, collectively forming a scannable QR pattern. From a user’s perspective, the code looked legitimate. From the perspective of many email scanners, however, there was no QR code image to analyze.
Technical Anatomy: HTML Tables as Pixel Grids
HTML tables are a foundational element of email design, widely supported across clients and rarely flagged as suspicious on their own. By carefully sizing table cells and alternating background colors, attackers recreated the pixel grid of a QR code. Because this structure contains no image data, traditional QR detection engines—which rely heavily on image analysis—were effectively bypassed.
Visual Degradation Without Functional Loss
Interestingly, the QR codes appeared slightly “squished” or compressed. This minor distortion did not prevent them from being scanned successfully by smartphone cameras. QR readers are designed with error correction in mind, allowing them to tolerate visual imperfections. This tolerance works in favor of attackers when experimenting with unconventional rendering methods.
Destination Infrastructure: Where the Codes Led
All QR codes in the campaign redirected victims to subdomains of the same parent domain: lidoustoo[.]click. With the exception of the earliest observed sample, which impersonated a OneDrive subdomain, the URLs followed a consistent structure. Each link incorporated elements derived from the recipient’s email address, alongside hexadecimal or decimal strings, likely used for tracking and victim identification.
Personalized URLs as a Phishing Enhancer
By embedding the recipient’s email address directly into the URL path, attackers increased the credibility of the landing page and improved their ability to track successful scans. This personalization also complicates automated analysis, as each recipient receives a unique URL rather than a shared indicator that can be quickly blocked.
Not a New Idea, but a Rare Deployment
Rendering QR codes with HTML tables is not a novel concept. Variations of this idea have been discussed in security research and conference presentations for years. What makes this campaign noteworthy is not the originality of the technique, but its real-world deployment in active phishing emails that successfully reached inboxes.
Summary of the Original Findings
The article highlights a phishing campaign that bypassed QR code detection by rendering QR codes using HTML tables instead of images. Sent over several days in late December, the emails contained minimal text and a scannable QR code built from colored table cells. These codes redirected victims to carefully structured phishing URLs hosted under a single domain. The campaign serves as a reminder that many security controls rely on assumptions about how malicious content is represented. When attackers break those assumptions, detection gaps emerge. The case also reinforces the broader lesson that technical defenses alone are insufficient, and that user awareness remains a critical component of effective security even as attack techniques evolve.
What Undercode Say:
Assumption-Based Security Is the Core Weakness
This campaign exposes a recurring issue in defensive security: reliance on assumptions. In this case, the assumption was that QR codes in emails will appear as images. Once that assumption became embedded in detection logic, it created a predictable blind spot that attackers could exploit with relatively simple HTML tricks.
Email Rendering as an Attack Surface
Email clients must support decades-old HTML features for compatibility reasons. Tables, inline styles, and background colors are all considered benign necessities. Attackers understand this and increasingly treat email rendering engines as an attack surface rather than just a delivery mechanism.
The False Comfort of Visual Familiarity
From a user’s perspective, the QR code looked normal enough. This familiarity is dangerous. Users are conditioned to trust certain visual patterns, and attackers exploit that trust by reproducing those patterns in unconventional ways that evade machine analysis but still persuade humans.
Why Image-Based Detection Falls Short
Most QR detection systems focus on image parsing, optical recognition, and pattern matching. HTML-rendered QR codes do not trigger these mechanisms because there is no bitmap to analyze. Without holistic content interpretation, security tools miss the threat entirely.
Socio-Technical Attacks Are Harder to Stop
This attack sits at the intersection of technical evasion and human behavior. Even if detection improves, attackers can continue to rely on user curiosity and compliance. As long as scanning a QR code feels safer than clicking a link, this vector will remain attractive.
Minimalism as a Delivery Strategy
The simplicity of the emails is not accidental. Fewer elements mean fewer opportunities for detection. By stripping the message down to its essentials, attackers reduce noise and increase the likelihood that their payload reaches the user intact.
Tracking and Attribution Challenges
The personalized URL structure complicates incident response. When every victim receives a unique link, traditional blocklists become less effective. This forces defenders to rely on behavioral and contextual signals rather than static indicators.
A Signal of Broader Trend Shifts
This campaign should be viewed as part of a larger trend toward “representation-layer attacks,” where malicious intent is hidden not in content itself, but in how that content is rendered. Similar techniques could easily be adapted to other visual elements beyond QR codes.
Defensive Implications for Email Security
Email security platforms will need to evolve beyond narrow detection models. Understanding layout semantics, color patterns, and rendering outcomes may become necessary to identify threats that intentionally avoid traditional markers.
User Awareness Remains Non-Negotiable
No matter how advanced detection becomes, users remain a critical line of defense. Training must evolve alongside threats, teaching users that QR codes are not inherently safer than links and should be treated with equal skepticism.
The Cost of Playing Catch-Up
Attackers iterate quickly because their costs are low. Defenders, constrained by compatibility, false-positive risks, and deployment cycles, often react slowly. This asymmetry ensures that novel evasion techniques like this will continue to surface.
Why This Matters Beyond This Campaign
Even if this specific method is quickly addressed, the underlying lesson persists. As long as defenses focus on “what” rather than “how,” attackers will continue to manipulate representation layers to stay one step ahead.
Fact Checker Results
Technical Accuracy of the Described Technique
The use of HTML tables to render scannable QR codes is technically feasible and accurately described. ✅
Validity of the Evasion Claim
Bypassing image-based QR detection using imageless rendering is a legitimate and documented evasion method. ✅
Broader Security Implications
The conclusion that user awareness and adaptive defenses remain essential aligns with current threat landscape realities. ✅
Prediction
Short-Term Detection Improvements
Email security vendors will likely add heuristics to detect QR-like table structures once this technique gains visibility. 🔍
Attacker Evolution Beyond Tables
Threat actors may experiment with CSS, SVG, or font-based QR rendering to stay ahead of new detections. ⚠️
Increased Focus on QR Code Risk Education
Organizations will place greater emphasis on educating users that QR codes are not inherently safe interaction mechanisms. 📉
🕵️📝✔️Let’s dive deep and fact‑check.
References:
Reported By: isc.sans.edu
Extra Source Hub (Possible Sources for article):
https://www.digitaltrends.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
Bing
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon
