A QRazy clever scam.

This report summarizes research into a large-scale “quishing” campaign that embedded unique QR codes in image attachments to hide phishing URLs, allowing most test emails to bypass SPF, DKIM, DMARC and Microsoft Defender and deliver over 1.6 million messages across multiple organizations. The attackers assigned unique QR codes and tracking IDs per recipient to evade detection, shifted execution to less-secure mobile devices, and were ultimately uncovered through AI-driven alerting combined with human analysis and threat hunting, highlighting gaps in email and mobile security and the need for QR code inspection and tighter controls.