Email security filters have spent decades learning to detect malicious images, hidden links and dangerous attachments. Attackers know this, and in recent months they have revived an old technique with a completely new application: building QR codes using nothing but text characters.
The result is an email that contains no image attachment whatsoever, yet the human eye reads it perfectly as a scannable QR code. Automated filters, however, only see text — and let it through.
🔍 Suspicious message?
Analyze senders, links or files in real time with our scanner.
What is an ASCII art QR code
A conventional QR code is an image: a PNG or JPEG file that security filters can analyse, extract the embedded URL from and verify whether it is malicious. This has led many email protection systems to include image analysis engines specifically designed to detect QR codes.
The ASCII art QR technique sidesteps this analysis elegantly: instead of embedding an image, the attacker constructs the visual pattern of the QR code using Unicode block characters — primarily the █ (full block) character and whitespace. The result is included in the email body as plain text or HTML.
From the security filter's perspective, there is no image to analyse. From the user's perspective, there is a perfectly readable QR code that any smartphone can scan.
Why it works
Security filters cannot extract the malicious URL from a QR code built with ASCII/Unicode block characters because it is technically not an image — it is text rendered visually.
The technique exploits a fundamental gap in how security systems categorise content: what looks like an image is not always technically one, and image analysis engines only activate when they detect actual image files.
Additionally, 73% of users scan QR codes without verifying where the link goes, making any variant of this technique a particularly effective attack vector.
The evolution: from quishing to ASCII quishing
Quishing — phishing via QR codes — was already an established threat before this variant emerged. In 2025, 1.7 million unique malicious QR codes were detected in email attachments alone.
The ASCII variant adds an extra evasion layer. Barracuda documented the appearance of QR codes built from ASCII/Unicode text blocks in October 2024 and anticipated that this tactic would continue to evolve. The Kaspersky report published this week confirms the technique remains active and in use in real campaigns.
Some attackers also combine this technique with Blob URIs — links that generate the phishing page content locally in the victim's browser without needing to host anything on an external server. These Blob URIs are created dynamically and can expire quickly, making them difficult for security systems to track and analyse.
How it reaches the user
The typical flow of an ASCII QR phishing attack is as follows:
- The victim receives an apparently legitimate email — a security alert, a delivery notification, a pending invoice.
- The email body includes what appears to be a QR code, with a message inviting the user to scan it to complete a verification or access a document.
- The user scans the code with their smartphone, which redirects them to a phishing page impersonating a legitimate service.
- The victim enters their credentials on the fake page.
The jump from computer to smartphone is intentional: mobile devices typically have fewer active security controls than managed corporate machines.
Warning signs
Although automated filters struggle to detect this technique, users can identify warning signs:
- Be suspicious of any email asking you to scan a QR code. Legitimate services rarely require this step for security verifications or document access.
- Verify the sender before scanning. A QR code in an email from an unknown sender or with a suspicious domain is a clear warning sign.
- Check the URL before entering any data. When you scan a QR code, your smartphone shows you the destination URL before opening it. Verify it matches the official domain of the service supposedly contacting you.
- Analyse the message in ORTSLAB before acting. If you receive an email with a suspicious QR code, paste the message text into the ORTSLAB scanner — the engine detects quishing patterns and analyses destination URLs in real time.
Conclusion
ASCII QR phishing is an example of how attackers adapt old techniques to new contexts to maintain their advantage over defence systems. Evasion creativity has no limit — and the response cannot rely solely on automated filters.
User awareness remains the most effective line of defence: be suspicious of unsolicited QR codes, verify the destination before scanning, and analyse any suspicious message before taking action.
Sources: Kaspersky Blog (May 2026) · Barracuda Networks Threat Spotlight (October 2024) · Acronis Cyberthreats Report 2026