Incident responders found phishing behind over 50% of the cases they worked on between March and June, up from a third the previous quarter.

 

What happened

Phishing was the initial attack vector in slightly more than half of the incidents requiring remediation between March and June 2026, according to Infosecurity Magazine's coverage of a quarterly incident response analysis published on July 28. The share had been roughly one third in the preceding quarter, making the jump one of the sharper single-quarter movements the researchers have recorded. Exploitation of public-facing applications and drive-by compromise, where a user picks up malicious code simply by visiting a compromised website, rounded out the leading entry methods. The figures come from real cases where responders were called in, rather than from survey data or telemetry, which makes them a measure of what actually worked rather than what was attempted.

 

Going deeper

The campaign researchers singled out routes its lures through a file format most email security tools treat as low risk. Attackers tracked as UAT-11764 send auto-generated PDF documents tailored to each recipient, each containing a QR code that leads to a Microsoft 365 credential harvesting page under the attacker's control, as reported by Infosecurity Magazine. Two design choices carry the attack past standard defenses. A QR code is an image rather than a link, so the URL inspection that email gateways perform on hyperlinks finds nothing to examine, and the harvesting pages sit on trusted cloud platforms that reputation filtering tends to allow. Once credentials are captured, the attackers create inbox rules to hide their activity and use the compromised mailbox to send the same lure onward to the victim's contacts. The campaign was still running as of late June.

 

What was said

"By weaponizing existing, trusted infrastructure like SharePoint and Microsoft 365," the actor can bypass many standard email security gateways, researchers wrote in the report published July 28, 2026, and reported by Infosecurity Magazine. Their guidance to defenders was specific rather than general, advising organizations to block or flag emails carrying QR codes inside PDF attachments, enforce phishing-resistant multifactor authentication on Microsoft 365 accounts, and monitor for suspicious inbox rule creation and unusual SharePoint file staging as markers of activity after a compromise.

 

In the know

Federal warnings about QR codes have concentrated on the consumer side of the problem. The FBI's Internet Crime Complaint Center issued a public service announcement about criminals mailing unsolicited packages containing QR codes that prompt recipients to hand over personal and financial details or download data-stealing software, often shipping without sender information to prompt a scan. The mechanism is the same in the enterprise version, since a QR code hides its destination until scanned, and the target reaches for a personal phone that sits outside every control the organization has configured. Nothing in a mobile device management policy governs the camera app on a nurse's own handset. Security awareness training built around hovering over links to check the destination gives staff no equivalent move when the destination is encoded in a square of pixels.

 

The big picture

Healthcare organizations run on PDF attachments, which is what makes this technique awkward to filter out. Referral letters, prior authorization forms, lab requisitions, and insurance correspondence all arrive that way from outside parties every day, so a blanket rule against PDFs from unknown senders would break workflows that clinical operations depend on. The narrower rule the researchers recommend, flagging QR codes specifically within PDF attachments, is workable because legitimate healthcare correspondence rarely needs one. Paubox's report on the top three healthcare email attacks found credential phishing leading to mailbox takeover caused more patient data exposure than any other email attack pattern in 2025, and the self-propagating step in this campaign is what turns one compromised account into a source of trusted-looking lures for everyone in the address book. Filtering that assesses attachment contents rather than sender reputation alone is where HIPAA compliant email protection has to operate for this category of attack.

 

FAQs

Why do QR codes bypass email security gateways?

Most gateways extract and analyze URLs from message text and attachments, checking them against reputation databases and detonating suspicious links in a sandbox. A QR code stores its URL as a visual pattern rather than as text, so unless the gateway decodes images, there is no link for it to evaluate.

 

What is a malicious inbox rule and how is it detected?

Attackers create mailbox rules that automatically delete or file away messages containing words like "phishing," "security," or the attacker's own domain, keeping the victim from noticing warnings or replies. Microsoft 365 audit logs record rule creation, and alerting on new rules that move or delete messages catches the behavior quickly.

 

Does phishing-resistant MFA stop a credential harvesting page?

It stops the attacker from using what they capture. FIDO2 keys and passkeys bind authentication to the legitimate site's address, so credentials entered on a lookalike page produce nothing usable. The user may still submit them, which is why monitoring for the attempt remains worthwhile.

 

What are outbound email thresholds and why do responders recommend them?

Limits on how many messages an account can send within a set period, which cap how far an attacker gets before the volume triggers an alert. Since compromised mailboxes are used to spread the same lure to contacts, throttling outbound volume interrupts propagation even when the initial compromise succeeded.

 

Should organizations block QR codes in email entirely?

Blocking is feasible for many organizations, though flagging is usually the better starting point since some legitimate senders use them for event registration or multifactor enrollment. Auditing which internal and vendor communications currently rely on QR codes before enforcing a block avoids breaking a process nobody documented.