"Scan to hear your voicemail": the 2021 QR campaign that named quishing

Picture the email. "You have a missed voicemail." Normal enough; most Microsoft 365 users get those. But where you'd expect an audio file or a play button, there's a QR code. Scan it to listen. Between 15 September and 13 October 2021, Abnormal Security stopped nearly 200 of these before they reached its customers. The code opened a Microsoft 365 login form sitting on an ordinary survey-tool website. The emails had come from real Office 365 accounts that had been taken over, so they passed DMARC and left from sender addresses already on the approved list. When Abnormal wrote it up on 26 October 2021, it said this was the first QR-code phishing it had ever seen working in email. No victim was named. No stolen password was confirmed. Status: caught and blocked, attacker never found, and one of the first "quishing" campaigns anyone documented.

How it worked

Think about what the attacker was asking of the victim. Read the email on your laptop. Reach for your phone. Point the camera at the screen. Log in on the phone. That's a lot of steps, and Abnormal's Crane Hassold reckoned the clumsiness held the success rate down. Still, there's a reason to want it. The phone isn't the laptop. No EDR on it, no browser isolation, no DNS filter. The one device your security team watches is the one the attack never touches.

A strange footnote: the pages were in English, the reCAPTCHA was in German. Most likely the survey platform had worked out where the attacker was sitting, not the victim.

Tip: a voicemail system sends you the audio, or a link to it. It does not ask you to take a photo of your own screen. When a QR code is the only door to a "message", walk away from the door.

The tells

• You can only get the voicemail by scanning something. No real system does that.
• You're being pushed from one device to another for no good reason.
• Scan it and you land on a survey-tool address, nowhere near Microsoft or your own company.
• English page, German CAPTCHA.

And here's what wasn't a tell: the sender. Real account, approved IP, authentication passed. Checking the From line would have made you feel better and told you nothing.

Why it matters

Ask around the industry when "quishing" became a thing and this campaign usually comes up. Consumers had already been warned (the Better Business Bureau put out a QR-scam alert in July 2021), but nobody had yet shown it working against corporate inboxes, at volume, with a write-up to prove it.

Three things it did became the standard kit. Send from accounts you've already stolen, so the reputation is borrowed. Park the fake login on a legitimate SaaS platform you don't own, and there's no bad domain for anyone to block. Push the victim onto a different device, and the corporate tooling never sees a thing. Fake parking fines, missed-delivery notices, "re-enrol your MFA" emails: the 2022 flood ran on the same three parts.

What stops it

• A QR code is a link wearing a disguise. Decode it and check the destination like you would any URL.
• Behaviour over authentication. When a real mailbox starts sending QR voicemails it never sent before, that's your alarm. DMARC will stay green the whole time.
• Passkeys or FIDO2 on Microsoft 365. Steal the password and you've stolen nothing useful.
• Tell staff about this exact lure. The scan is the compromise, and it happens on their phone, off your network.
• Notice when a survey or form tool starts hosting login pages. That's your own trusted vendor being borrowed.
• Stop treating a DMARC pass as a clean bill of health. Here the "attacker" was, cryptographically, the real account.

See also quishing, credential harvesting and phishing.

Common questions