One Malicious QR Code Hidden in a Legitimate Booking Confirmation

# One Malicious QR Code Hidden in a Legitimate Booking Confirmation

A booking confirmation email arrived from a national golf-entertainment venue. The authentication was perfect: SPF, DKIM, and DMARC all passed through a well-known marketing platform. The content was convincing: personalized booking details, venue address, cancellation policy, and social media links. Buried in the message was one QR shortlink. That link was flagged malicious.

What the Attack Looked Like: A Transactional Email Used as Cover

The email read like any standard booking confirmation. It included a personalized reservation (name, location, date, time, rental type), real waiver and booking-management links, and a recognizable brand layout. A recipient scanning the message for signs of fraud would have found none in the text or structure.

One element did not belong: qrco[.]de/bfcrKs, a QR shortlink embedded alongside otherwise-clean content. QR shortlinks and URL shorteners are common in legitimate marketing emails. That normalcy is exactly why they are useful to attackers. A shortlink obscures its final destination, and in a message with a dozen real, clean links, one malicious shortlink is easy to overlook.

The marketing infrastructure itself was legitimate. The bounce domain pointed to an authenticated marketing-service path. The sending IP (mta213a-ord[.]mtasv[.]net, 104[.]245[.]209[.]213) belongs to a well-known transactional email provider (ActiveCampaign). The email passed full DMARC p=reject enforcement.

Why the Authentication Signal Cannot Be Trusted Alone

DMARC p=reject is the strongest enforcement posture a domain can publish. This message passed it. That result tells the receiving mail stack one thing: the message was authorized by the domain owner's infrastructure. It says nothing about the content of every link inside the message.

Phishing via QR code succeeds specifically because it injects a malicious shortlink into an otherwise-legitimate message flow. If a marketing account is compromised, or if an attacker plants a malicious QR code template into an existing campaign, all of the authentication signals remain green. The brand's DKIM key is signing the message. The marketing provider's SPF record is covering the sending IP. Every trust signal that email authentication provides is intact, and none of them touch the shortlink payload.

See Your Risk: Calculate how many threats your SEG is missing

How It Was Caught: Per-Link Scanning and Malicious Verdict on the Shortlink

The incident data shows that qrco[.]de/bfcrKs was the only URL in the message to receive a malicious verdict from the link scanner. Other links in the message were either rated clean (the venue's own domain pages) or listed as not-scanned (the waiver provider link). The malicious verdict on a single element was sufficient to classify the entire message as phishing.

Themis (our Adaptive AI) evaluates each link independently and aggregates across the full message. A message is not cleared because nine of ten links are clean. One confirmed malicious element escalates the verdict for the whole delivery.

The sender was also flagged as high-risk and as a first-time sender to the recipient mailbox, which added corroborating weight to the malicious link signal before the scanner even returned its verdict.

Defender Takeaways: Any-Malicious-Link Means Block, Not Average

The instinct to weigh "most links are clean" against "one link is malicious" is the wrong frame. A single confirmed-malicious URL is a binary indicator. Phishing campaigns embed one bad link in otherwise-clean content precisely because defenders sometimes average across signals rather than treating each element as independently actionable.

Concrete controls:

1. Block on any-malicious, not majority-malicious. If any URL in a message resolves to a malicious verdict, the message is phishing.
2. Treat QR shortlinks and URL shorteners with elevated scrutiny in transactional mail. Legitimate booking confirmations do not need to obscure their destination URLs.
3. High sender-risk plus first-time sender plus authenticated transactional infra is a recognizable cluster. Authenticated marketing channels are abused in social engineering campaigns because trust in the channel is high.
4. Block qrco[.]de shortlinks broadly if QR phishing activity is observed in your environment; shortlink services used in one campaign are frequently reused.

See the MITRE ATT&CK technique references at https://attack.mitre.org/techniques/T1566/ and https://attack.mitre.org/techniques/T1204/.

Indicators of Compromise