HTML tables facilitate clandestine QR code phishing

Threat actors have been able to deploy stealthier QR code phishing campaigns by using HTML tables, instead of image attachments, for illicit QR code generation, reports Cybernews.

Multiple phishing emails delivered from Dec. 22 to Dec. 26 had HTML tables for QR code rendering, circumventing email service providers' QR code discovery and analysis mechanisms, according to an analysis from the SANS Technology Institute's Internet Storm Center. Further examination of the emails showed a basic layout with minimal text luring recipients to scan the accompanying QR code to review and sign a document.

Scanning the QR code, which has pixels housed in a 35x35 table, redirects to credential-stealing phishing sites. Such findings highlight the growing sophistication of methods employed by threat actors to bypass security defenses.

"Purely technical security controls can never stop all potentially malicious content especially content that has a socio-technical dimension," said the report.