Infocon: green

This report describes a December phishing campaign that rendered QR codes using HTML tables (black/white table cells) instead of images to evade email security scanners; the malicious QR codes redirected recipients to subdomains of lidoustoo.click with recipient-specific URL structures. The author includes code examples, observed URL patterns, and sample dates (Dec 22–26) to demonstrate the technique and warn defenders about detection assumptions.