New QR Code-Based Quishing Attack Targets Microsoft Users

A new QR code-based quishing campaign has been uncovered that specifically targets Microsoft users, deploying seemingly innocent document review prompts to lure victims. Attackers bypass traditional antivirus and PDF-scanning defenses by splitting the QR code into two image objects within a PDF, rendering each half separately so the full pattern only appears when viewed together.

They also draw the QR modules programmatically via PDF content-stream commands rather than embedding a standard image, a technique designed to evade image-based scanners while remaining legible to human eyes and mobile cameras. The campaign begins with a phishing email that appears to come from DocuSign, informing recipients they have a document to review and sign, with a QR code that blends into the document’s design to thwart heuristics.

After scanning, users are redirected to a counterfeit Microsoft login page that mimics the official portal, where credentials are exfiltrated in real time and could be used to access corporate email, OneDrive and other Microsoft cloud services; post-exfiltration, attackers may attempt multifactor bypass or deploy further phishing internally, or pivot to ransomware or data-scraping malware.

Mitigations include strict PDF content-stream analysis, monitoring for anomalous login attempts, and enforcing multifactor authentication across accounts.