A Hijacked ISP Mailbox, a QR Code, and a Clean DKIM Pass

The email arrived with the recipient's own name in it. Not a generic "Dear valued employee," but a personalized note addressed to a specific quality-assurance engineer at an industrial manufacturing company, referencing their exact work address and wrapped in the language of an HR announcement. There was no link to hover over, no attachment to scan. The entire call to action was a single QR code, rendered inline in the body, with a line of text urging the recipient to scan it and open a document.

That is the whole trick. By collapsing the payload into a scannable image and dressing the message in a trusted internal identity, the attacker removed almost everything a traditional filter is built to inspect and shifted the final step onto a device outside the company's controls.

The Payload Was a Picture, Not a Link

The QR code was delivered as a CID inline image. CID stands for content-ID, and it means the graphic is embedded directly inside the HTML body of the message rather than fetched from an external web server. That distinction matters. A text-based link scanner parses the body looking for URLs to evaluate, and finds nothing, because the destination is not text at all. It is a matrix of black and white squares that only resolves into a web address once a camera decodes it. In this case the code's destination was never recovered, so the second-stage landing page stayed out of reach of the analysis, which is exactly the outcome the attacker was engineering.

Embedding the code as a CID image also sidesteps the external image fetch that some gateways use as a reputation signal. Nothing calls out to a remote host at render time. The only thing that reaches the attacker's infrastructure is the victim's personal phone, after it scans a code the corporate mail stack never had a chance to read. This is the core of a QR-based phishing attack, often called quishing: move the malicious URL off the wire and into a graphic, then let the target's own camera complete the delivery.

It Borrowed Trust From a Hijacked ISP Mailbox

The sending identity is where the personalization did its work. The From address resolved to webmaster@eircom[.]net, a generic administrative mailbox on a long-established Irish ISP domain that has been in service since the late 1990s. Dressed on top of it was a display name reading as an HR function, padded with a long random token (HR #5cbgawd53tbek16sldtvwh3wjtzroagfpre). A legitimate human resources team does not send from a decades-old consumer ISP webmaster account, but the domain behind it carries real reputation, and that reputation is what let the message through.

Walk the authentication results and the sleight of hand becomes clear. SPF returned a softfail, because the true sending IP 68[.]232[.]156[.]88 was not authorized in the envelope domain's SPF record. On its own that is a warning sign. But DKIM passed, with a valid signature for eircom[.]net, and DMARC passed as well, aligned to that same domain under a permissive p=none policy, with a composite authentication pass (reason=100) on top. A gateway that treats a DKIM and DMARC pass as a green light would deliver this without a second look. The message transited a Cisco IronPort, also branded Cisco Secure Email, gateway on the relay path (esa2.hc1188-58.c3s2.iphmx[.]com), whose header markers confirm the vendor. No single check was wrong. Each answered its narrow question honestly. But the questions they answer, which domain signed this and does the sender align, say nothing about whether a legitimate mailbox was hijacked and repurposed.

Authentication confirms provenance, not intent. A DKIM signature proves a message really came from eircom[.]net. It cannot prove that the account behind it was not taken over and pointed at a stranger. This is why account-level abuse is such a durable technique, and why layered account takeover protection has to reach past the authentication checkmark to the behavior of the account itself.

Mapping to MITRE ATT&CK

• T1566 Phishing covers the core delivery, a targeted message engineered around a social-engineering pretext and a personalized HR identity.
• T1204.001 User Execution: Malicious Link covers the QR code itself. The link is real, it is simply encoded in a graphic so that a human, not the mail stack, is the one who follows it.
• QR-code CID delivery functions as an evasion sub-pattern layered on the T1566 delivery, hiding the destination from text-based inspection and moving execution onto an unmanaged device.

Indicators of Compromise

The Signals That Actually Mattered

Nothing on the authentication layer was going to catch this, and that is precisely the lesson. The tells were behavioral. A generic webmaster mailbox posing as an HR team is an identity mismatch no SPF record can express. A first-time sender addressing a named individual by full name and email address, the VIP-personalization pattern, is a targeting signal, not an authentication one. And a message whose only content is an image-encoded call to action is anomalous on its face for an HR communication.

This is the terrain Themis, our Adaptive AI analyst, is built to read. Rather than stopping at "DKIM passed, DMARC aligned, deliver it," Themis weighs the claimed identity against the sending mailbox's history and the intent baked into the content, the way a seasoned analyst would. Here it flagged the message at 89 percent confidence with labels for credential theft and VIP recipient, catching an attack that every technical checkmark had already cleared. The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and names stolen credentials as the single most common way in, present in 38 percent of them, which is exactly what a QR-borne login page is engineered to harvest.

The Takeaway

QR-code phishing wins by relocating the attack. The malicious URL leaves the message body, where your gateway can read it, and reappears on a personal phone, where it usually cannot be seen at all. Pair that with a hijacked but genuinely authenticated mailbox, and the two signals a defender leans on most, the link and the sender's authentication, both come back clean.

Treat a passing DKIM or DMARC result as evidence of provenance, never proof of intent. Decode QR images at the gateway rather than trusting the picture, scrutinize any HR-branded message from an unfamiliar external domain, and put behavioral analysis in front of the authentication verdict rather than behind it. Reinforce the habit with employees, because a QR lure is only as strong as the willingness to scan it, and regular phishing simulation testing that includes quishing scenarios teaches people to distrust a code that asks them to log in from their phone. CISA's guidance on stopping phishing early (https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one) and NIST's working definition of phishing (https://csrc.nist.gov/glossary/term/phishing) are solid references for building that muscle across a team.