[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSQEUGyh4YYb_GRG_QmMC5t_vgoInMbtE8doh97mxqG0":3},{"article":4,"iocs":38,"watch_terms":42,"solutions":43,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":22},"778eb08d-ea08-4b17-9408-020d9e7b0b8d","Quish Splash QR Code Phishing Campaign Hits 1.6 Million Users","quish-splash-qr-code-phishing-campaign-hits-1-6-million-users","7AI research reveals a massive QR code phishing attack that evaded SPF, DKIM, and DMARC. Find out how 1.6 million emails went undetected.","Security researchers at 7AI uncovered a sophisticated phishing campaign called 'Quish Splash' that successfully bypassed SPF, DKIM, DMARC, and Microsoft Defender by embedding malicious QR codes in BMP image attachments. Between 26 February and 18 March 2026, the attacker Baron Lester sent over 1.6 million emails across organizations in a coordinated three-wave strategy, leveraging unique hash images to evade detection and exploiting mobile devices outside corporate security perimeters.","Quish Splash QR code phishing campaign evaded email auth, hit 1.6M users in three weeks.","https:\u002F\u002Fhackread.com\u002Fquish-splash-qr-code-phishing-hits-users\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002Fquish-splash-qr-code-phishing-hits-users.jpg","2026-03-26T16:21:46+00:00","2026-03-26T17:00:23.454309+00:00",8,[],"80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":17,"icon":19,"name":20,"slug":21},null,"Vulnerabilities","vulnerabilities",[23,28,33],{"category":24},{"id":25,"icon":19,"name":26,"slug":27},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":29},{"id":30,"icon":19,"name":31,"slug":32},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":34},{"id":35,"icon":19,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":32,"value":40,"context":41},"Quish Splash","Large-scale QR code phishing campaign targeting 1.6M users via image-embedded malicious links",[],{"controls":44,"vendors":128},[45,72,101],{"slug":46,"name":47,"problem":48,"products":49},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[50,56,64],{"vendor_slug":51,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":51,"url":54,"description":55},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"slug":73,"name":74,"problem":75,"products":76},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":102,"name":103,"problem":104,"products":105},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[106,113,120],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":107,"product_name":110,"url":111,"description":112},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":102,"product_name":117,"url":118,"description":119},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[129],{"slug":130,"name":131,"logo_path":132,"roles":133},"7ai","7AI","\u002Fvendor-logos\u002F7ai.png",[134],"reported_by",{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"qr-code-phishing-campaign-bypasses-email-security-controls","QR Code Phishing Campaign Bypasses Email Security Controls","The Quish Splash campaign demonstrates how attackers can exploit users' lack of awareness about QR code risks while simultaneously bypassing traditional email security measures. By embedding malicious QR codes in BMP image attachments, the attackers circumvented SPF, DKIM, DMARC, and Microsoft Defender protections, reaching 1.6 million users. The campaign's success relied on users scanning QR codes with mobile devices that operate outside corporate security perimeters. This attack highlights the critical gap between desktop email security and mobile device vulnerability when users interact with seemingly innocuous visual elements.",[140,141,142,143,144],"CIS Control 14","CIS Control 7","NIST SP 800-53 AT-2","NIST SP 800-53 SI-8","NIST Cybersecurity Framework PR.AT-1",{}]