QR Code Hidden in Plain Sight: How a qrco.de Shortcode Inside an Image-Only Invoice PDF Defeated Text Scanners

The malicious link in this attack was never visible to a scanner. It was encoded inside a QR code, printed into an image, embedded in a PDF, and attached to what looked like a routine quarterly invoice.

A recipient at a financial services organization received an email purporting to carry a 1Q26 invoice. The sender was a long-established investment advisory firm, a domain registered in 2009 with clean DKIM, SPF, and DMARC results by the time the message reached the recipient's inbox. The firm appears to have had its email environment compromised; the sending domain is a victim, not attacker infrastructure. The message body was sparse: "Please see the attached 1Q26 invoice." A signature block followed, complete with a Houston office address and a phone number. The PDF was the entire payload.

The Image-Only PDF as a Scanner Dead Zone

The attached PDF, roughly 18 KB, was image-only. No extractable text. No machine-readable URLs. From a text-based scanner's perspective, the document was blank: a raster image of a page rather than a document with parseable content. That is not an accident. Image-only documents are a deliberate construction designed to defeat the class of scanners that operate on extracted text and link enumeration.

Inside that image was a quishing payload: a qrco.de QR shortcode. The qrco.de domain is a legitimate QR code shortening service that, like any URL shortener, can be weaponized to redirect scan targets to arbitrary destinations. In this case, the shortcode qrco[.]de/GGarciaCNBC was flagged malicious by the link scanner. OCR was not available in the sandbox environment at scan time, meaning the scanner could not rasterize the PDF and decode the QR region. The malicious determination came from prior intelligence on that specific qrco.de path, not from decoding the QR in real time.

MITRE ATT&CK T1566.001 covers spearphishing via attachment. The attachment here was not a macro-bearing Office document or a PDF with an /OpenAction trigger. It was an image embedding a QR code, a mechanism that routes the actual threat delivery to a mobile device camera rather than a desktop link click. T1204.002 (user execution: malicious file) applies when the victim scans the QR code; at that point, the phone's default browser opens the shortcode destination, entirely outside the corporate email security perimeter. T1036 (masquerading) covers the invoice pretext that makes the attachment look like a legitimate business document.

Authentication Noise from the Exclaimer Proxy

The relay path included us2.smtp.exclaimer.net, an Exclaimer email signature management relay. Exclaimer rewrites outbound messages to append standardized corporate signatures, and that rewrite can alter the message envelope in ways that cause intermediate authentication checks to record an SPF permerror and a DMARC fail at that hop. Those are exactly the results seen in the intermediate X-MS-Exchange-Authentication-Results header.

The downstream authentication picture is different. ARC sealing preserved the upstream authentication chain, DKIM passed against the sending domain's selector, and the final Authentication-Results recorded SPF pass, DKIM pass, and DMARC pass. The intermediate errors are Exclaimer's expected side effect, not evidence of spoofing.

This matters because defenders monitoring authentication failures in mail flow logs may see those intermediate results and either dismiss them as noise (correct in isolation) or incorrectly conclude the message is clean because the final result passed (incorrect conclusion when the attachment contains a QR payload). Authentication tells you about the message envelope's integrity. It tells you nothing about a QR shortcode printed into a rasterized PDF page.

See Your Risk: Calculate how many threats your SEG is missing

One Signal Found in the Email Body

The analysis flagged one phone number discrepancy in the signature block. The number in the email differed slightly from the number listed on the firm's public contact page. Small contact-data mismatches like this are a recurring signature of phishing kits assembled from older template data or automated mail merges that pull stale records. The discrepancy alone is not decisive, but paired with an image-only PDF and a malicious QR shortcode, it is consistent with a compromised account being used to distribute a pre-built lure.

The image-based phishing technique has expanded beyond simple screenshot emails to encompass rendered PDFs, embedded images in HTML bodies, and now QR-bearing document attachments. In each variant, the attacker's goal is the same: present a visually convincing artifact while ensuring there is no text-layer representation of the malicious element for scanners to process.

Defending against this requires detection that operates at the image and document rendering layer, not just text extraction. IRONSCALES detects behavioral signals including first-time external sender patterns, mismatches between signature data and public records, and attachment-type anomalies that deviate from an organization's communication baselines. The platform's Adaptive AI also flags the combination of a sparse email body with a heavyweight attachment from an unverified sender relationship as a risk signal independent of any URL verdict.

Invoice fraud attempts using compromised legitimate sending domains are particularly difficult to block at the gateway level. The sending domain passes authentication, the body contains no alarming text, and the attachment's malicious payload is invisible to text-based analysis. Behavioral and image-layer analysis closes that gap.

Indicators of Compromise