QR without an image: PhishU implements text-rendered quishing

Quishing is a phishing technique that uses QR codes. PhishU has implemented text-rendered QR in its framework for authorized phishing assessments: the QR code is visually present, but the email contains no image object.

Kaspersky researchers observed QR codes built from Unicode characters in real-world phishing attacks. PhishU initially reproduced this approach, but in Gmail Mobile the characters were stretched, making the QR code impossible to scan. The developers therefore switched to an HTML table made up of black and white cells.

This introduced its own problems: the initial markup was about 230 KB, while Gmail clips messages at around 102 KB, and Outlook recolored white cells gray in dark mode. Merging adjacent same-color cells using colspan reduced the markup to 50–65 KB, while a separate override addressed Outlook's dark-mode recoloring.

As a result: HTML markup → visual QR → camera scans it → image scanner has no image object to analyze The QR code can still contain a unique link for each recipient.

Why this works Protection against quishing often follows this pipeline: find an image → detect the QR code → decode the URL → check the link Text-rendered QR has no <img> tag, attachment, or embedded image. If email security scans for QR codes only in image objects, the code may go undetected. Blocking remote images does not help either: the QR code is rendered directly from the email markup and remains visible even when images are disabled.

If a Secure Email Gateway fully renders the email and scans its visual output for QR codes, it can detect this variant as well. The technique primarily works against systems where QR analysis is triggered only after an image object is found — effectively following the logic: «no image → no QR».

Article: https://phishu.net/blogs/blog-text-rendered-qr-phishing-in-the-phishu-framework.html