QR-Code PDFs Steal Microsoft 365 Logins

How the Attack Worked

Cisco Talos incident responders identified phishing as the initial access vector in just over half of incidents investigated between March and June 2026. A significant part of that activity was an ongoing, persistent campaign tracked as UAT-11764. The campaign uses auto-generated, victim-tailored PDF documents that contain QR codes. Instead of clicking a link, victims are prompted to scan a QR code with their phone, which routes them to an adversary-controlled Microsoft 365 credential harvesting page.

The phishing pages are hosted on trusted cloud platforms, which helps the campaign blend in with legitimate traffic. By weaponizing existing, trusted infrastructure like SharePoint and Microsoft 365, the operators can bypass many standard email security gateways that would otherwise flag suspicious links.

Why It Succeeded

The core reason this technique evades detection is that the malicious destination is embedded inside an image, the QR code, rather than in text that gateways can scan. Because the lure looks like a normal document review request, and the destination login page appears to sit on familiar Microsoft infrastructure, victims have little visual reason for suspicion.

Once credentials are stolen, attackers do not stop at account access. They create email inbox rules for defense evasion, which can hide replies or alerts, and they use the compromised mailbox to send further phishing emails to the victim's contacts. This self-propagating step extends the campaign's reach without additional attacker infrastructure and increases the chance that recipients trust the message because it comes from someone they know.

What to Watch For

• Unexpected PDF attachments that ask you to scan a QR code to "sign in" or "view a document."
• Authentication prompts that appear only after scanning a QR code, especially for Microsoft 365.
• Messages from known contacts containing unusual sign-in requests, which may indicate their account has already been compromised.
• Unexplained changes to inbox rules, which can be a sign of post-compromise defense evasion.

Building Resistance

• Treat QR codes in unsolicited or unexpected PDFs as suspicious, and verify the request through a separate, known communication channel before scanning.
• Enforce phishing-resistant multi-factor authentication on Microsoft 365 accounts so that stolen passwords alone are not enough for attackers to gain access.
• Monitor for suspicious inbox rule creation and anomalous SharePoint file staging as indicators of post-compromise activity.
• Remember that hosting on a well-known cloud platform does not guarantee legitimacy; attackers routinely abuse trusted services like SharePoint and OneDrive to host credential harvesting pages.

How does the QR-code PDF phishing campaign work?

Victims receive an auto-generated, victim-tailored PDF containing a QR code. Scanning it leads to an adversary-controlled Microsoft 365 credential harvesting page hosted on trusted cloud infrastructure.

Why do QR codes in PDFs bypass email security?

Because the malicious link is embedded as an image inside a QR code rather than as plain text, it evades detections used by many traditional email gateways to identify potentially malicious behavior.

What happens after credentials are stolen in this campaign?

Attackers access the victim's inbox, create email inbox rules for defense evasion, and use the compromised account to send further phishing emails to the victim's contacts.

What can organizations do to reduce risk from this attack?

Enforce phishing-resistant multi-factor authentication on Microsoft 365 accounts and monitor for suspicious inbox rule creation and anomalous SharePoint file staging.