Microsoft users are facing a novel quishing campaign that leverages weaponized QR codes embedded in malicious emails.<\/p>\n\n\n\n
Emerging in early October 2025, this attack exploits trust in QR-based authentication and device pairing workflows, tricking targets into scanning codes that deliver infostealer binaries.<\/p>\n\n\n\n
Initial reports surfaced when Gen Threat Labs analysts noted anomalous QR attachments spoofing<\/a> Microsoft branding within corporate Office 365 notifications.<\/p>\n\n\n\n Recipients who scanned the codes were redirected to a compromised Azure CDN node hosting a staged payload delivery sequence.<\/p>\n\n\n\n Following its emergence, researchers identified multiple infection vectors. One involves a phishing email purporting to be a Microsoft Teams alert, instructing users to scan a QR code to resolve an urgent security issue.<\/p>\n\n\n\n