HTML-Rendered QR Phishing Evades Image Extraction and OCR-Based Email Scanning

QR-code phishing, commonly known as quishing, is evolving beyond image-based payloads.

Threat actors are now rendering scannable QR codes directly from HTML tables or text within email bodies, leaving no image attachment, embedded bitmap, or <img> element for traditional email scanners to inspect.

The technique targets a structural blind spot in Secure Email Gateways (SEGs). Conventional anti-quishing controls identify an image, decode the QR payload, extract the destination URL, and assess it against reputation data, redirect chains, and phishing intelligence.

The company said QR-phishing detections surged fivefold during the second half of 2025, underlining the broader growth of QR-based social engineering.

In the observed lures, emails impersonated business partners and instructed recipients to scan a code to access or sign an alleged confidential DocuSign document, ultimately directing victims to credential-harvesting pages.

A QR code is fundamentally a matrix of dark and light modules. Attackers do not need a PNG or JPEG to display that matrix.

They can construct it using an HTML <table> containing hundreds of tiny cells, each assigned a black or white background color, or reproduce the grid through Unicode and ASCII-style block characters.

The recipient’s email client renders those components as a visible, camera-readable QR code. A smartphone scans it normally, even though the email contains no traditional image artifact.

Internet Storm Center researchers documented a real-world campaign using HTML tables to render QR codes.

The samples, sent between December 22 and December 26, used a minimal lure with a visually “squished” QR block.

The encoded URLs pointed to personalized subdomains under lidoustoo[.]click, with recipient email addresses embedded in URL paths an indication that the campaign was designed for tracking and targeted delivery.

This approach matters because image-based inspection pipelines generally begin with image extraction.

If the gateway does not identify an image, its QR decoder and OCR engine may never execute. The malicious URL remains concealed inside the rendered visual grid until a victim scans it.

PhishU Researchers said that, HTML-rendered QR codes disrupt that workflow because the malicious destination exists only in the visual arrangement of markup, not as an immediately extractable hyperlink or image object.

HTML-Rendered QR Phishing

Email clients often suppress remote images by default, requiring users to select “show images.” That control can reduce exposure to remotely hosted image-based QR codes, but it does not stop QR codes drawn from email markup.

An HTML table is part of the message body and is rendered locally by the email client. As a result, the QR code may remain visible even when external images are blocked.

The attack effectively converts a visual payload into a layout problem.

Text-character QR codes face a different limitation: email clients can alter font size, spacing, and line height. Gmail mobile, for example, may distort monospace glyphs enough to make a text-drawn QR unscannable.

Table-based rendering is more reliable because cell widths, heights, and background colors are broadly supported by legacy email engines, including Gmail and Outlook.

However, the method introduces operational constraints. A naïve table implementation can create very large HTML messages.

Gmail may clip messages around the 102KB threshold, potentially cutting a QR table mid-render and corrupting the visual code.

Attackers or red-team operators can mitigate this by compressing same-color runs with colspan, reducing markup while preserving the QR matrix.

The security implication is straightforward: no image does not mean no QR code. Defenders should expand quishing detection beyond attachments, inline images, and OCR pipelines.

Mail security platforms should render suspicious HTML in an isolated environment, inspect the resulting visual output, and attempt QR decoding from screenshots or reconstructed DOM content.

Detection logic can also flag dense HTML tables made of very small black-and-white cells, anomalous use of bgcolor attributes, repeated fixed pixel dimensions, and blocks of Unicode characters arranged in QR-like grids.

Organizations should correlate those signals with sender reputation, brand impersonation, authentication failures, redirect behavior, and QR-themed language such as “scan to review,” “scan to sign,” or “scan to access document.”

User awareness remains essential. Employees should treat any QR code requesting corporate credentials as suspicious and access business services through known bookmarks, approved applications, or manually entered URLs instead of scanning an unsolicited code.

Kaspersky noted that a text-formed QR code in a business email should be regarded as a high-risk phishing indicator rather than a harmless formatting choice.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.