New Quishing Attack With Weaponized QR Code Targeting Microsoft Users

A sophisticated quishing campaign has emerged, specifically targeting Microsoft users by employing QR codes embedded in malicious emails. This attack, first identified in early October 2025, leverages the inherent trust in QR-based authentication mechanisms to deliver infostealer binaries.

The attack initiates when users scan QR codes that appear within spoofed Microsoft Office 365 notifications. These codes redirect users to compromised Azure CDN nodes that facilitate a payload delivery process.

Researchers have identified several infection vectors, including phishing emails masquerading as Microsoft Teams alerts or Microsoft Authenticator enrollment prompts. These emails urge users to scan QR codes to address purported security issues or to enable enhanced login protection.

Upon scanning the QR code, the victim receives a short URL leading to a malicious redirector script. This script conducts environmental checks, such as verifying the Windows locale, checking Defender versions, and identifying sandbox indicators, before downloading a Packaged Infostealer (PI) executable.

The executable establishes persistence by creating a scheduled task named “MSAuthSync,” ensuring execution with each user logon. Extracted credentials and system telemetry are then exfiltrated over HTTPS to attacker-controlled endpoints.

A notable feature of this attack is its QR code AV evasion technique, which involves splitting the QR code into two overlapping images within PDF content streams. Standard QR decoders typically overlook such nonstandard configurations, but a custom parser can recombine these image layers for decoding.

The following Python code snippet demonstrates how defenders might reconstruct and decode these split QR codes:

Load the two image layers

layer1 = Image.open('qr_part1.png').convert('RGB') layer2 = Image.open('qr_part2.png').convert('RGB')

Recombine by taking the brighter pixel from each

merged = Image.new('RGB', layer1.size) pixels1, pixels2 = layer1.load(), layer2.load() for x in range(layer1.width): for y in range(layer1.height): pixels = pixels1[x, y] if sum(pixels1[x, y]) > sum(pixels2[x, y]) else pixels2[x, y] merged.putpixel((x, y), pixels)

Decode the merged QR code

codes = zbarlight.scan_codes('qrcode', merged) print('Decoded URL:', codes[0].decode())

This method underscores the need for comprehensive analysis techniques in combating modern phishing campaigns.

Based on reporting by Cyber Security News.