Beware of New Phishing Tactic Using Text-Based ASCII QR Codes

Cyber attacks via electronic mail continue to evolve with techniques that are increasingly difficult to detect. After the widespread use of images to hide malicious links, cybercriminals are now returning to a classic yet effective method: text-based graphics or ASCII art to form QR codes.

According to the latest data from Kaspersky, threats using QR codes (QR phishing) have experienced a significant surge. In the second half of 2025, the number of detected attacks increased fivefold compared to the previous period. This trend indicates that cybercriminals are increasingly relying on QR codes as a primary entry point to steal sensitive data.

Historically, ASCII (American Standard Code for Information Interchange) graphics were used on early-generation computers that were unable to display images. However, this technique, introduced in 1963, is now being repurposed by spammers and phishing actors. By arranging text characters to form a QR code pattern, attackers can deceive email security solutions that typically only scan image attachments or direct links.

The scheme discovered by Kaspersky researchers follows a neat fraud pattern. Victims typically receive an email impersonating a business partner, often using urgent themes such as signing confidential documents via popular platforms like DocuSign. Within the email, the victim is asked to scan the text-based QR code to access the document. Instead of an official document, the code directs the user to a fake website designed to steal corporate credentials.

Roman Dedenok, Antispam Expert at Kaspersky, explained that this trick is a systematic attempt to evade security technology. "Previously we saw phishing actors trying to hide URLs in images. Now they are returning to text to display QR codes in order to avoid image-based scanning," he said. Dedenok stressed that the use of ASCII art for QR codes is almost certainly an illegal attempt. "Any instance where a QR code asks someone to enter corporate credentials on a mobile device should immediately raise suspicion. This trick has only one purpose: to bypass security technology," he added.

To anticipate these evolving threats, companies are advised to strengthen their digital defences. Kaspersky recommends using comprehensive email server security solutions, such as Kaspersky Security for Mail Server. This solution is designed to handle various modern threats, from spam and malware infections via email, to more complex fraud schemes like Business Email Compromise (BEC) and these newly identified text-based QR code attacks.