WhiteMail
← Back to blog
·WhiteMail Security Team#weekly-report#quishing#lookalike-domains

Weekly Security Report #2 — QR phishing and look-alike domains

Two techniques showed up together often enough this week to be worth pairing: QR-code phishing ("quishing") and look-alike domains. Separately they are old. Combined, they are built to beat the scanner and the human at the same time.

This week

We saw a steady stream of messages whose only call to action was a QR code rendered as an image — "scan to view the secure document," "scan to re-validate your account." There was no clickable link in the body at all.

That is the point. A QR code is just pixels to most email filters. The malicious URL never appears as text, so URL reputation and link-rewriting never get a target. And because people scan QR codes with a personal phone, the click happens off the managed device entirely — outside most controls.

Technique in focus: beating the scanner and the eye

  • Against the scanner: the destination lives inside an image. No href, no text URL, nothing to reputation-check — unless something actually decodes the QR.
  • Against the human: the decoded domain is a near-miss of a brand you trust. A swapped character, an extra word, a different but plausible TLD. On a small phone screen, with a sense of urgency, it reads as legitimate.

The landing page is usually a faithful clone of a login screen. The only thing that gives it away is the address bar — which is exactly what a hurried person on a phone does not check.

What you can do

  • Be skeptical of any email whose primary action is a QR code, especially one that claims to be about security, payments, or account validation.
  • If you must scan, read the decoded URL before you open it, and check the domain character by character against the real one.
  • Treat "scan with your phone" as a relocation of the attack to your least-protected screen — and slow down accordingly.

WhiteHat decodes QR codes as part of SA-03 (Links and Visual) and checks the resulting domain with SA-02 (Infrastructure), so a link hidden in an image is treated as exactly what it is: a link.

Have a sample with a QR code? Drop it into the Analyze console and watch SA-03 pull the destination out.