Nothing to Click: A QR Code Hidden Inside an Attached Email

The email had nothing in it to click. No link, no button, no URL anywhere in the visible body. What a senior engineering executive at a mid-sized manufacturing-sector employer saw when the message opened was a single picture, and the picture was his own company's logo.

That was the whole visible message. Underneath it sat one attachment, Voice.Mail.eml, holding a second complete email whose only instruction was to scan a QR code with a phone.

The Subject Line Was Misspelled on Purpose

The subject announced a new voice-fax message from a phone number, tagged it for accounts payable, and gave it a fifty-nine-second duration. Read at speed it is a voicemail notification. Dumped to code points it is something else: seven characters are not ASCII.

Three are precomposed accented letters sitting where plain vowels belong. The other four matter more, because the base letters are still ordinary ASCII and the accent is a separate combining code point appended right after them: a combining diaeresis on an s, a combining acute on an f, a combining circumflex on a t. Visually the words still read as new, message, from, accounts and payable. To a keyword rule or an exact-match subject cluster, none of those words are present at all.

The tell is what the attacker left alone. The nested message's subject, the one no filter would ever parse, is pure ASCII with no diacritics and a different phone number. The evasion sits exactly where the machine reads and nowhere else.

The Body Was One Image, and the Brand Was the Victim's Own

Three elements rendered: Microsoft's advisory banner noting the recipient does not often get email from this sender, the organization's external-sender caution banner, and one inline image referenced by content ID. No other text, no other element.

The image was the recipient's employer's own logo and wordmark, not a vendor's. Brand-impersonation detection is tuned to notice an outside brand appearing where it should not originate, and here there is no second brand and no vendor relationship to explain away. The message simply looks like it came from inside the building, which is impersonation with the mismatch signal deliberately removed.

The Payload Was One MIME Level Down

The attachment was declared as a generic binary stream, 387,396 bytes, verdict "Clean." A scanner finding no malicious code is not the same as the file being harmless. Deep extraction of it failed outright with a file-not-found error, so nothing downstream ever parsed its contents.

Its contents were an entire second email, From a display name of "Voicemailcenter" at a voicemail alias on the recipient's own domain. Built with a templated bulk-mail markup framework, it held three inline PNGs and nothing else: a generic blue voicemail icon, the QR code, and a Microsoft four-square logo above a Microsoft copyright line. The copy claimed one unheard voicemail and told the reader, twice, to scan the code to hear it. The greeting addressed the recipient by the stem of their own email domain rather than by name, a template variable filled with the wrong field.

Decoding the QR image yields a URL on a .dev subdomain whose last path segment, after a dollar-sign delimiter, is the recipient's full email address. That pre-fill pattern is the standard shape of a credential-harvest page that greets the visitor with their own address already in the form. The page was never fetched, so what it asked for is not established, and the registry publishes no WHOIS, so no claim about the domain's age or ownership is possible either.

See Your Risk: Calculate how many threats your SEG is missing

Across both layers there is not one http byte belonging to the attacker. The only links anywhere are two font-stylesheet imports and the recipient gateway's own help pages. Nothing to rewrite, reputation-check or detonate. The only exit from this message is a phone camera, a device the enterprise stack does not see.

A Pass That Was Manufactured Downstream

The authentication story is the exact inverse of the pattern most teams have learned to dismiss. At its true origin, a hosting-provider VPS in the Netherlands whose reverse DNS does not resolve, the message authenticated at nothing. SPF softfail. No DKIM signature at all. DMARC none. No ARC. It then transited the spoofed sender domain's own Microsoft 365 tenant and that domain's outbound commercial gateway, and by the time it reached the target it read SPF pass, DMARC best-guess pass, ARC chain valid, and composite authentication pass with reason code 109. The recipient's Microsoft 365 scored it at the lowest spam confidence and delivered it to the Inbox.

The familiar false positive runs the other way: a message that authenticated cleanly upstream and fails at the last hop only because the recipient's own gateway touched it after signing. This is the opposite. It failed upstream and passed downstream. The pass was manufactured by the relay chain rather than earned by the sender, and two surviving SPF header lines in the delivered message flatly contradict each other about the same email. DKIM is absent at every hop, so nothing was ever cryptographically bound to the content.

The spoofed sending domain belongs to an unrelated US medical practice. Whether a mailbox there was taken over or a connector was misconfigured is not established, and it is not the attacker. Its outbound gateway passed the message along as designed, and is a bystander too.

Why the Extractor Recorded Zero Codes

The incident record lists an empty QR array and an empty OCR array. Zero codes found, zero text recovered, in an attack whose entire payload is a QR code. Extraction ran against the message it was handed, and that message contained one logo. The code was a level deeper.

What caught it was the shape rather than any artifact. Our Adaptive AI scored the message at 87 percent confidence with credential-theft and VIP-recipient labels, on a first-time sender pairing to a mailbox already flagged as high value, and resolved the incident automatically as phishing. One mailbox affected, no action taken by the recipient.

What to Change Tomorrow

Recurse. A message/rfc822 attachment is a message, and every check that runs on an inbound email should run again on any email inside it: link and image extraction, QR decoding, OCR, header analysis. If QR detection only runs at the top level, an attacker gets past it with a two-second drag-and-drop. That applies to QR-code controls and credential-harvesting controls equally, because both are useless against a payload they never reach.

Normalize Unicode before keyword matching. Stripping combining marks and folding precomposed characters to their base letters would have made this subject match every rule it dodged. Evaluate authentication per hop and keep the origin result, because a final-hop pass earned through a legitimate relay says nothing about who sent the message. And treat an all-image body carrying your own brand as a signal in its own right.

The 2024 Verizon Data Breach Investigations Report puts the human element in 68 percent of breaches and phishing in 15 percent, and cases like this are why that number stays stubborn. CISA's phishing guidance and NIST's definition of phishing both frame the target as a person's judgment, and here the technical surface was reduced almost to nothing, so judgment was the only control left. A voicemail you did not expect, arriving as a picture, asking you to point your phone at a square, is worth ten seconds of suspicion no matter whose logo is on it.

Indicators of Compromise

MITRE ATT&CK Mapping