A common sign is a document that looks polished and branded but contains little or no text in the email body, with the real call to action pushed into a PDF. Other indicators include legitimate-looking annotations that point to trusted domains, a QR code that requires URL extraction, and extra redirects that make analysis slower and less reliable.
How QR Code Phishing Hides from Basic Email and Attachment Scanners
The most telling pattern is that the lure is designed to look harmless until a person opens the attachment and follows the visual path instead of the text path. Attackers use the PDF as a delivery container, then move the real action into an image-based QR code, which reduces the amount of machine-readable content available to standard text and URL scanning.
Because the malicious destination is embedded visually, the attachment can evade simple reputation checks that rely on extracted links from the email body or document text. The workflow is often intentionally indirect: branding in the document, short supporting text, and a QR image that must be interpreted before any destination can be checked.
- Look for a polished layout that feels legitimate but contributes little actual text.
- Watch for a QR code that is the only practical path to the destination.
- Treat annotations, captions, or arrows that point to trusted-looking domains as part of the lure, not proof of safety.
Why Extra Redirects and URL Extraction Steps Are a Red Flag
Attacks built for evasion often add friction for defenders on purpose. A QR code may resolve to a chain of redirects, an intermediate tracking page, or a dynamically generated URL that changes the effective destination after initial inspection, which makes static analysis less reliable and slows down automated detonation.
The more steps required to extract, unwrap, and validate the final destination, the more opportunity the attacker has to hide the true target behind benign-looking infrastructure. That is especially suspicious when the visible document content is sparse, the QR code is prominent, and the apparent brand or logo does not match the actual redirect chain.
- Compare the visible brand in the document with the final domain after all redirects.
- Check whether the QR content requires image decoding, manual extraction, or multiple follow-up requests.
- Be cautious when a trusted domain appears in a caption or note, but the QR target resolves elsewhere.
Risk and Threat Considerations
QR-based phishing works well because it shifts the decisive step from machine-readable content to human interpretation. That creates a gap where email security tools, attachment scanners, and URL filters may see only a benign PDF or a harmless image while the user is the only part of the chain that can still reach the real payload.
Failure mechanism: The attacker minimizes extractable text, embeds the lure in a QR image, and uses redirects or intermediate pages so scanners cannot reliably resolve the final destination before the victim does.
Impact: The campaign can bypass automated inspection, increase click-through risk, and deliver credentials or malware through a path that is harder to triage quickly.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 9 — Email and Web Browser Protections | QR phishing is delivered through email attachments and web links. |
| CIS 8 — Audit Log Management | Redirect chains and extraction steps are easier to investigate when request and click telemetry is retained. | |
| CIS 16 — Application Software Security | Document and attachment handling needs controls that reduce malicious embedded-content abuse. | |
| Recommendation — Harden email and web filtering to inspect attachments and block suspicious redirect chains. Retain and review mail, proxy and endpoint logs to reconstruct the full destination path. Validate attachment handling paths and detonation workflows against image-embedded phishing payloads. | ||
| NIST CSF 2.0 | PR.PT — Protective Technology | Automated scanning and content inspection are protective technologies directly challenged by QR evasion. |
| DE.CM — Continuous Monitoring | Detecting evasive QR phishing depends on monitoring for suspicious document and redirect behavior. | |
| Recommendation — Tune protective inspection so image-based lures and redirect chains are not trusted by default. Monitor for document patterns that rely on image-only actions and multi-step destination resolution. | ||
| MITRE ATT&CK | T1566 — Phishing | The scenario is a phishing delivery pattern using an attachment to initiate the user action. |
| T1204 — User Execution | The attack depends on the recipient scanning or following the QR code by choice. | |
| T1027 — Obfuscated Files or Information | The QR image and redirect layering obscure the true destination from automated inspection. | |
| Recommendation — Map suspicious QR attachment campaigns to phishing activity and hunt for the delivery chain. Assume user execution is required and prioritize controls that reduce trust in image-based lures. Treat image-encoded destinations and redirect wrappers as obfuscation signals in detection logic. | ||
Practitioner Guidance
What to verify: Inspect the document structure, not just the link target. A QR-heavy PDF with little body text, brand decoration without substantive content, or mismatched destination branding deserves manual review before trust is assigned.
What to prioritize: Extract and resolve the final URL chain, then compare the result with the claimed sender, brand, and attachment context. If the only actionable element is a QR image, treat the attachment as an evasive delivery mechanism rather than a normal document.
Practitioner takeaway: The key judgement is whether the attachment is readable by scanners in the same way it is readable by a person, and QR-phishing is designed precisely to make those two views diverge.
Related resources from NHI Mgmt Group
- What are the signs that a phishing kit is trying to evade automated security analysis?
- What are the signs that a QR code phishing attempt is likely to be malicious?
- What are the signs that a phishing or spear phishing campaign is designed to evade traditional email controls?
- How can organisations reduce QR-code phishing in AI-assisted browsing workflows?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
