Why do compromised email accounts make QR code phishing harder to stop?

Compromised accounts make quishing harder to stop because messages originate from legitimate infrastructure, trusted IP space, and sometimes pass DMARC checks. That removes many of the obvious indicators defenders rely on. Once the sender is trusted, security tools have less reason to block the message, so intent analysis and account-level anomaly detection become much more important.

Why trusted accounts make quishing harder to filter

Compromised email accounts change the threat model for qr code phishing because the message no longer looks obviously suspicious at the transport layer. Defenders often start with sender reputation, authentication results, and known-bad infrastructure, but a hijacked mailbox can borrow the trust of the real user, making malicious content arrive through a channel that already has established legitimacy.

The problem is not just delivery, it is credibility. A QR code in a message from a real coworker, supplier, or customer can bypass the instinctive scepticism that a fresh domain or spoofed sender would trigger. That shifts the defender’s job from blocking an external lure to deciding whether a legitimate account is being abused for malicious intent.

Compromise also reduces the value of simple rule-based mail filtering. If the attacker is sending from a valid mailbox, traditional controls may see normal authentication, familiar infrastructure, and ordinary communication patterns, even while the body content contains a QR code leading to credential theft or session capture. MailChimp breach is a useful reminder that socially engineered account access can convert trusted communication channels into delivery vehicles for wider abuse.

Why DMARC and sender reputation are not enough on their own

DMARC, SPF, and DKIM are still valuable, but they mainly answer whether a message is authorised to use a domain, not whether the sender’s mailbox has been taken over. A compromised account can pass many of the normal trust checks because the infrastructure and identity are real, even though the intent is hostile. That is why quishing often survives the first layer of email defence.

When this happens, defenders need to look beyond message provenance and into behavioural signals. Unusual login geography, impossible travel, abnormal sending bursts, inbox-rule changes, forwarded-mail creation, and sudden shifts in content type are more useful than the presence of a QR code alone. Poland Military Breach shows how compromised email credentials can expose sensitive communications even before downstream phishing or fraud is detected.

That is why email authentication should be treated as a baseline trust control, not a complete abuse detector. Once the account itself is legitimate, the security question becomes whether the behaviour of that account still matches the user or system that owns it.

What defenders should inspect when the sender is already trusted

Once the sender is trusted, intent analysis becomes more important than content-only filtering. The strongest indicators are often outside the QR image itself: newly registered reply addresses, shortened or obfuscated destinations, unexpected urgency, or links that redirect into credential collection, OAuth abuse, or mobile-first login pages. CoPhish OAuth Token Theft via Copilot Studio illustrates how phishing can evolve into token theft when the victim is pushed into a trusted-looking flow.

QR code phishing is also harder to stop because scanning happens off the email platform. Once a user moves from inbox to phone camera or mobile browser, many desktop controls no longer apply, and the user often loses contextual cues such as full URL inspection or mailbox warnings. That makes the initial message quality and the behavioural suspicion around the sender more important than the QR artifact itself.

For security teams, the practical implication is that inbox controls, identity signals, and endpoint telemetry need to be correlated. If an account suddenly starts sending QR-based lures, treat it as an identity abuse problem as much as a phishing problem.

Risk and Threat Considerations

Compromised email accounts create a high-trust delivery path for malicious QR codes, which increases the chance that a phishing message reaches users and escapes routine filtering. The attacker is not trying to look unusual, they are trying to look like a normal, trusted sender, and that lowers defender visibility at exactly the wrong point in the chain.

Failure mechanism: A valid mailbox, trusted IP space, and normal authentication results can conceal malicious content, so perimeter mail controls and reputation-based filtering lose much of their discriminating power.

Impact: More quishing messages land in inboxes, more users are likely to scan them, and the organisation must rely on behavioural detection, account monitoring, and downstream identity controls to catch abuse after delivery.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-02 — Secret Leakage	Compromised mailboxes often expose tokens and credentials used for further abuse.
	NHI-04 — Insecure Authentication	Trusted-account compromise and reused authentication paths are central to this phishing risk.
	NHI-05 — Overprivileged NHI	A hijacked account with excessive access increases blast radius after quishing succeeds.
Recommendation — Rotate exposed secrets quickly and invalidate any tokens tied to the compromised account. Harden mailbox authentication and require phishing-resistant login methods where possible. Reduce account privilege so a compromised mailbox cannot pivot into broader abuse.
MITRE ATT&CK	T1566 — Phishing	QR code phishing is a phishing delivery technique used to steal credentials or tokens.
	T1078 — Valid Accounts	The attack depends on abusing a real, trusted account to evade basic trust checks.
Recommendation — Map QR-phishing telemetry to T1566 and tune detections for malicious message delivery. Hunt for abuse of valid accounts when trusted senders begin issuing suspicious QR messages.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Account compromise and token abuse are directly reduced by credential lifecycle control.
	AU-6 — Audit Review, Analysis, and Reporting	Mailbox abuse is best surfaced through anomaly review of login and sending activity.
	AC-6 — Least Privilege	Limiting account privilege reduces the impact when a trusted mailbox is abused.
Recommendation — Enforce authenticator rotation and revoke credentials tied to compromised mailboxes. Review mail and sign-in logs for account behavior that diverges from normal use. Apply least privilege so a hijacked account cannot reach high-impact systems.

Practitioner Guidance

What to prioritise: Focus on account abuse detection before trying to classify every QR image. A sender that is authentic but acting abnormally is a stronger warning signal than an unauthenticated message with an obvious lure.

What to verify: Check login history, mailbox rule changes, forwarding configuration, and recent send patterns when a QR phishing report comes in. If those signals move together, assume the account is part of the attack path until proven otherwise.

What practitioners underestimate: The hardest part is not identifying that a QR code exists, it is recognising that the account sending it may have already become the adversary’s trusted relay.

Practitioner takeaway: Effective quishing defence depends less on blocking a suspicious message and more on detecting when a legitimate account has turned into a trusted delivery mechanism for hostile intent.