The QR Link With No QR Code in a Calm Telecom Bill Lure

The link said www[.]pelephone[.]co[.]il. It went to a QR-code service. And there was no QR code anywhere in the message.

That is the whole trick in one line. A Hebrew email impersonating Pelephone, one of Israel's mobile carriers, reached an employee at an Israeli real-estate investment company and was forwarded internally to a colleague. Every clickable element, the main button and the footer anchor dressed up as the carrier's own address, resolved to a short link issued by a commercial dynamic QR-code service. The message's scanned image and OCR records were both empty. The QR service was never used for a QR code. It was used as an editable redirector.

The second trick is quieter. The email never threatens anything.

A Billing Notice Written to Sound Boring

The lure reads like the least alarming email a carrier could send. The periodic charge on the registered payment method failed. The card might be expired or need re-approval. A button offers to update payment details, and a reassurance line promises the process "takes less than a minute, secure, free of charge." It is signed "Pelephone team" and carries the carrier logo, pulled from a public email-editor image bucket.

No deadline. No suspension. No "act within 24 hours."

That restraint is deliberate. Language models and keyword filters that score urgency, fear and deadlines would read this body as a routine account notice. The 2026 Verizon Data Breach Investigations Report puts the human element in 62% of breaches and notes that AI-assisted text in malicious emails doubled year over year. Polished, calm copy is cheap now. Scoring tone alone is a losing bet.

The Threat Lives One Redirect Away

Click the button and the short link 301-redirects to a path on a third-party Italian IT company's development subdomain. The path itself is a tell: /pele/archive/Pelephone_Israsel/, with "Israel" misspelled.

The landing page replicates Pelephone site chrome behind a modal titled "Important notice." This is where the pressure finally appears. The modal says the carrier tried to reach the customer several times about an unpaid account, and if payment is not received by the deadline, the line will be blocked for incoming and outgoing calls, SMS, MMS and internet. Two buttons: "Pay now" and "Close."

So the attack splits its own persuasion in half. The email carries trust. The landing page carries fear. Neither half alone looks like a complete phishing attempt. The only way to see the whole thing is to follow the link and read what is on the other end.

See Your Risk: Calculate how many threats your SEG is missing

Why a Dynamic Link Changes the Inspection Problem

A dynamic QR service exists so a business can print a code once and change where it points later. The short link behind that code is the product. Strip the image away and you are left with a hyperlink whose destination its account holder can edit at will.

To be clear about the evidence: this record shows exactly one destination. Nothing here proves the target was changed after delivery. The point is the capability. A link built to be re-pointed means the verdict a scanner reaches at delivery describes the destination at that moment, not a permanent fact about the URL. A clean result at send time and a cloned payment page an hour later are both possible from the same string.

The service also lends the link something a fresh attacker domain cannot buy: a registered, years-old domain that hosts plenty of legitimate traffic. The service is a bystander here. Its short link was abused.

The footer anchor deserves its own note. Displaying www[.]pelephone[.]co[.]il as anchor text while the href points elsewhere is old-school masquerading (MITRE T1036). It works because most people who hover at all hover over the button, not the footer.

Mapping the Chain to MITRE ATT&CK

The email itself came from a local web-application user on a Japanese shared web host, sending as an address at an unrelated Japanese domain. The From display name and subject were built from the send date, 25102026, plus a reference number.

Indicators

What Actually Catches This

The detection that worked here did not depend on the email body sounding suspicious. IRONSCALES Malware and URL Protection followed the short link through its redirect, landed on the cloned Pelephone page, scored the link malicious and resolved the incident as Malicious Content. The affected mailbox was quarantined automatically. The Themis recommendation on the record carried a confidence of 90.

Three takeaways for defenders:

Treat a QR-service domain in an href as a redirector, not a code. If the message has no scannable image, a QR-service link is just a pointer whose target can move. Resolve it every time, ideally at click as well as at delivery.

Score the destination, not only the message. A split-pressure lure is built to pass body-only analysis. The threat language, the payment prompt and the brand clone all sat on the landing page. CISA phishing guidance frames this as stopping the attack cycle early, and early means following the link.

Compare anchor text to href on every link, including footers. A visible brand domain that points to a third-party service is a strong signal by itself. The NIST definition of phishing centers on impersonating a trustworthy entity, and a mismatched anchor is that impersonation in a single line of HTML.

Phishing is still the initial access vector in 16% of breaches in the 2026 DBIR, and the FBI IC3 2024 report keeps showing why impersonation of trusted service providers pays. For teams running Microsoft 365, the M365 augmentation layer is where link-following and community signals from 36,000+ security professionals across 18,000+ organizations (IRONSCALES platform data) add depth to native filtering.

A calm email is not a safe email. Sometimes it is just the first half of the argument.