In August, attackers emailed a file called "Your-Q3-Compensation-Summary.docx" to more than 10,000 people at over 4,800 organizations. Microsoft says the campaign went after professional services — law firms especially.
Inside the document was a QR code. That's the whole trick.
Your email security reads text. A link in a message body gets scanned, scored, often stripped. Turn that same link into a picture of a little square and most gateways have nothing to read.
Then it gets worse. The person pulls out their phone to scan it, which means they've just left the laptop you spent real money securing and landed on a personal device with no filtering, no monitoring, and a browser bar too small to show the actual domain.
The page looked like a Microsoft sign-in and asked for a short code to be typed into a genuine Microsoft website. That part is real, which is exactly why people fall for it. Approve it and the attacker is holding a live session inside the mailbox, without ever tripping the MFA prompt again.
For a firm, that's someone sitting in a partner's email. Wire instructions. Client strategy. And eventually a phone call you really don't want to make.
Two things worth checking this week: does your team know a QR code is just a link, and can anyone approve a sign-in without you hearing about it?
Worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email