New QR Code-Based Quishing Attack Targets Microsoft Users

A sophisticated phishing campaign using weaponized QR codes has been identified, specifically targeting Microsoft users with document review requests.

This campaign employs advanced evasion techniques, such as splitting the QR code into two separate images, using non-standard color palettes, and drawing the code via PDF content streams. These methods allow attackers to bypass traditional antivirus and PDF-scanning defenses.

The phishing emails appear to originate from DocuSign, prompting recipients to review and sign a document. The email includes a QR code rendered in a non-standard color spectrum, designed to blend into the document's design and evade conventional QR-scanner heuristics.

Analysis reveals that the QR code is divided into two image objects within the PDF file. Each half of the code is rendered independently and aligned to appear as a single QR pattern. This technique evades signature-based detection systems that typically search for complete image QR patterns.

Instead of embedding the QR code as a standard image, attackers use PDF content-stream commands to draw the QR modules programmatically, issuing precise instructions for each module. This approach renders the code accurately for human viewers and mobile camera scanners but bypasses scanners relying on image extraction, thereby avoiding many PDF security filters.

The Attack Workflow and Payload Delivery

Upon scanning the deceptive QR code with a smartphone or tablet, users are redirected to a counterfeit Microsoft login page on a domain mimicking the official Microsoft portal. This page features legitimate-looking Microsoft branding and requests users to enter their credentials for "secure document access." Captured credentials are exfiltrated in real-time, granting unauthorized access to corporate email, OneDrive documents, and other Microsoft cloud services.

Post-credential theft, attackers might deploy multifactor bypass simulations, send push-notification prompts to users, or subtly alter account settings to maintain persistence. Compromised accounts are used to propagate further phishing messages internally, leveraging trust within the organization to execute additional social engineering attacks.

Exfiltrated data may be monetized on dark web marketplaces, or campaigns may pivot to deploying ransomware payloads or data-scraping malware within the victim’s network.

Defending against this quishing threat requires combining technical controls, user awareness training, and robust incident response planning. Organizations should enforce PDF scanning policies that include content-stream analysis capable of detecting non-image QR-drawing instructions.

Advanced threat protection solutions must scrutinize PDF rendering commands, flagging anomalies such as multiple image objects forming a single QR code. Users should verify QR code sources before scanning and cross-check unexpected document requests through alternative channels. Encouraging the use of official document portals directly, rather than QR-scanned links, can reduce exposure to manipulated QR codes.

Multifactor authentication should be enforced across all accounts, using hardware tokens or biometric methods rather than SMS or app-push notifications to minimize the risk of credential-based account takeover. Security teams need to monitor for anomalous login attempts and domain registrations resembling legitimate Microsoft endpoints.

Rapid takedown procedures for fraudulent domains and coordinated disclosure with hosting providers can significantly reduce the opportunity for attackers. Proactive threat hunting and intelligence sharing regarding indicators of compromise in quishing payloads will further strengthen organizational resilience.

As quishing techniques evolve, combining evasion methods with deceptive branding, maintaining vigilance remains crucial. Users and security teams must adopt layered defenses to counter weaponized QR code attacks and protect critical Microsoft assets.

Based on reporting by GBHackers.