Abnormal Security "Missed Voicemail" QR Quishing Campaign (2021)

What Happened

Between September 15, 2021 and October 13, 2021, Abnormal Security detected and blocked nearly 200 phishing emails sent to its enterprise customers that disguised QR codes as "missed voicemail" notifications. Scanning the QR code led victims to a Microsoft-credential phishing page hosted on a legitimate enterprise survey service, with backend infrastructure on Amazon/Google IPs. The emails were sent from genuinely compromised Outlook/Office 365 accounts belonging to victim organizations, often from already-approved sender IPs and passing DMARC, and used six distinct sender personas tailored to match each target's industry. Abnormal published the findings on October 26, 2021, describing it as one of the first functional cases of QR-code-based email phishing ("quishing") it had observed, arriving a few months after a July 2021 Better Business Bureau consumer alert had already flagged QR-code scams as an emerging risk.

How the Attack Worked

The actor first tried (Sept 2021) hiding a malicious URL behind an image styled to look like a .WAV voicemail attachment; a security vendor caught that version. The actor then iterated to a QR code embedded directly in the email body: QR codes are images, so secure email gateways' URL-scanning and attachment-scanning features do not decode or check what a QR code actually links to, letting the message through as an ordinary image attachment. The email body impersonated a "missed voicemail" / "encrypted voicemail" notification urging the recipient to scan the code to listen. Because QR codes cannot be clicked on the same device the email is read on, the intended victim flow was: open the email on a computer, then use a phone camera to scan the code, which opened a mobile browser to the phishing page, a device-hop that itself moves the interaction off any corporate-monitored endpoint or network. The phishing pages, designed to harvest Microsoft 365 usernames and passwords, were hosted not on attacker-registered lookalike domains but on a legitimate enterprise survey/form-building service, with backend IPs registered to Amazon or Google, again borrowing trusted, unblockable infrastructure. Oddly, despite all text being in English, the pages served a German-language reCAPTCHA, suggesting the survey platform geolocated the attacker (not the victim) to Germany. Delivery itself used compromised legitimate Outlook/Office 365 accounts at victim organizations, sending from already-approved sender IPs and frequently passing DMARC authentication outright, since the "attacker" was, cryptographically, the real account. Six distinct sender personas were used across the campaign, most tailored to match the target's own industry. Fresh QR images were generated the same day as each send, defeating image-hash/blocklist reputation systems.

The Lure & the Tell

The lure: an email styled as an automated "missed voicemail" / "encrypted voicemail" notification containing a QR code to scan for playback, exploiting the routine, low-suspicion nature of voicemail-to-email notifications that most M365 users already receive legitimately, and using a QR code specifically because it looked benign (just an image) to both the recipient and to security scanners. The tell, per Abnormal's own analysis: QR codes in a business email asking you to scan-to-listen are not a standard voicemail delivery mechanism (real systems attach audio files or provide a direct playback link, not a photo you must scan with a separate device); the forced device hop from computer to phone is itself unusual and should prompt suspicion; the landing page's mismatched German reCAPTCHA on an all-English page was a visible inconsistency; and the underlying domain, once scanned, was a generic third-party survey-tool URL rather than any Microsoft or organizational domain, a direct giveaway that no legitimate voicemail system would route through a survey platform.

Outcome

Abnormal Security identified and blocked the campaign's emails for its own customer base before public disclosure; the company states it detected and stopped almost 200 such emails between Sept 15 and Oct 13, 2021. No breach, fraud, or confirmed successful credential theft tied to this specific campaign was publicly reported; the disclosure is framed as a threat-intelligence "we caught this" writeup rather than a post-breach incident report. The threat actor was never identified or attributed; Abnormal's Director of Threat Intelligence, Crane Hassold, called it the first functional QR-code-in-email phishing case his team had observed and noted the awkward victim flow (needing to open the email on one device and scan with another) likely limited the campaign's real-world success rate. The campaign is widely cited in the security industry as marking the emergence of "quishing" as a distinct, named attack category, arriving shortly after a July 2021 Better Business Bureau consumer scam alert about QR codes more generally.

Why It Matters

This campaign is widely cited as one of the earliest vendor-documented instances of QR-code phishing via email at enterprise scale, and it demonstrated a structural blind spot that persisted for years afterward: secure email gateways and native cloud-email security controls scanned URLs and attachments for known-bad indicators, but treated QR codes as opaque images, never decoding the embedded link to check it. It also showcased two techniques that became staples of later quishing waves: hijacking legitimately compromised accounts/trusted-brand infrastructure to inherit sender reputation and pass authentication checks, and hosting phishing pages on legitimate third-party SaaS platforms (survey tools, form builders, cloud storage) rather than attacker-registered lookalike domains, denying defenders any domain-reputation signal to act on. The campaign also illustrated the "device-hop" property unique to QR phishing: forcing the target to move the interaction from a monitored corporate computer to an unmanaged personal phone, sidestepping corporate EDR, browser isolation, and network-level URL filtering entirely, a property that made the vector both awkward (limiting immediate success) and, in hindsight, a preview of the much larger quishing surge (fake parking tickets, delivery notices, MFA re-enrollment lures) that followed industry-wide from 2022 onward.

Defenses

Abnormal's own writeup frames the core lesson: legacy secure email gateways and native M365/Google controls scan links and attachments for known-bad URLs/hashes: a QR code embedded as an image, sent from a legitimate (compromised) account, with a landing page freshly hosted on a legitimate SaaS domain, matches none of those signatures. Effective defenses that would have caught this class of attack: (1) behavioral/anomaly detection that flags compromised-account sending patterns and unusual sender/content combinations rather than relying on URL/attachment reputation; (2) treating QR codes in email as first-class scannable objects (decode-and-check the underlying URL against threat intel, same as any link) rather than an unscanned image; (3) user training specifically on quishing, since scanning shifts the click from a monitored corporate device/network to an unmanaged personal phone, evading EDR, browser isolation, and DNS filtering entirely; (4) phishing-resistant MFA (FIDO2/passkeys) on M365 accounts so a harvested password alone is insufficient; (5) vendor/SaaS abuse monitoring: flagging survey-tool or form-builder domains suddenly hosting credential-harvesting pages, since attackers piggyback on the target domain's own good reputation; (6) DMARC/DKIM alignment checks alone were insufficient here because the sending account itself was legitimately compromised, so the abuse must be caught by account-behavior signals, not authentication-protocol pass/fail.