Quish Splash QR Code Phishing Campaign Hits 1.6 Million Users
Quish Splash QR code phishing campaign evaded email auth, hit 1.6M users in three weeks.
Security researchers at 7AI uncovered a sophisticated phishing campaign called 'Quish Splash' that successfully bypassed SPF, DKIM, DMARC, and Microsoft Defender by embedding malicious QR codes in BMP image attachments. Between 26 February and 18 March 2026, the attacker Baron Lester sent over 1.6 million emails across organizations in a coordinated three-wave strategy, leveraging unique hash images to evade detection and exploiting mobile devices outside corporate security perimeters.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe Quish Splash campaign demonstrates how attackers can exploit users' lack of awareness about QR code risks while simultaneously bypassing traditional email security measures. By embedding malicious QR codes in BMP image attachments, the attackers circumvented SPF, DKIM, DMARC, and Microsoft Defender protections, reaching 1.6 million users. The campaign's success relied on users scanning QR codes with mobile devices that operate outside corporate security perimeters. This attack highlights the critical gap between desktop email security and mobile device vulnerability when users interact with seemingly innocuous visual elements.
What helps against this
How we list vendors
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Quish Splash