Rant: QR-code phish in forwarded screenshots are making mail filtering ridiculous
The worst email lures in our queue lately are not clever links. They're a screenshot of a fake login or benefits message forwarded from a phone, with the only URL buried in a QR code inside the image.
Now the mail gateway has to OCR a mobile screenshot, find the QR code, resolve it, sandbox the landing page, and still decide before the user opens it. Half the time the text is compressed, cropped, or wrapped in some "scan this to view secure message" nonsense.
This is the part that annoys me: the attacker moved the URL out of the MIME structure entirely. No href, no attachment exploit, no sender auth failure to hang a decision on. Just pixels.
Users are also trained to treat QR codes as normal because every restaurant, invoice portal, and event check-in normalized them. Asking a mailbox control to infer intent from a blurry forwarded image feels like we turned email security into document forensics.
end of rant