QR Code Phishing Campaign Bypasses Email Security Controls

The Quish Splash campaign demonstrates how attackers can exploit users' lack of awareness about QR code risks while simultaneously bypassing traditional email security measures. By embedding malicious QR codes in BMP image attachments, the attackers circumvented SPF, DKIM, DMARC, and Microsoft Defender protections, reaching 1.6 million users. The campaign's success relied on users scanning QR codes with mobile devices that operate outside corporate security perimeters. This attack highlights the critical gap between desktop email security and mobile device vulnerability when users interact with seemingly innocuous visual elements.

Tactical Insight

Immediate actions

Organizations should implement enhanced email security solutions capable of analyzing image attachments for embedded malicious content, including QR code scanning and analysis

Long-term improvements

This attack could have been prevented through comprehensive security awareness training specifically addressing QR code risks and social engineering tactics targeting mobile devices
Mobile device management (MDM) policies should extend security controls to personal devices accessing corporate resources, and email filtering should be configured to scrutinize BMP and other image formats more rigorously
Regular phishing simulation exercises incorporating QR code scenarios would help users recognize and report suspicious communications