QR Code Phishing Campaign UAT-11764 Bypasses Security Gateways

On July 28, 2026, Cisco Talos released its Q2 2026 Incident Response (IR) Trends report, delivering a stark warning to enterprise cybersecurity leaders: adversary tactics have shifted decisively toward advanced identity compromise. Phishing has surged to become the primary initial access vector in over 50% of all investigated incident response engagements—a significant escalation from prior quarters. At the focal point of this intelligence disclosure is an active, persistent campaign attributed to a threat cluster designated as UAT-11764. Operating with remarkable technical agility, UAT-11764 leverages highly tailored social engineering alongside sophisticated QR code phishing (popularly referred to as “quishing”) to compromise enterprise Microsoft 365 (M365) environments, bypass traditional security controls, and systematically hijack corporate identity infrastructure.

The campaign highlights a broader shift in the threat landscape. As organization-wide adoption of Secure Email Gateways (SEGs) and Multi-Factor Authentication (MFA) has matured, adversaries have adapted by abandoning plain-text malicious links in favor of visual payloads and proxy-based authentication attacks. By embedding dynamic QR codes inside auto-generated PDF documents and hosting credential harvesting infrastructure on trusted cloud environments, UAT-11764 has successfully rendered many legacy perimeter security controls effectively blind.

The Mechanics of UAT-11764: Advanced QR Code Phishing in Action

The operational playbook of UAT-11764 demonstrates how modern threat actors combine low-tech visual obfuscation with high-tech identity abuse to penetrate fortified enterprise environments. Rather than relying on simple bulk spam runs, UAT-11764 executes multi-stage attack chains designed to exploit architectural trust boundaries at every step.

Phase 1: Detection Evasion via PDF-Embedded QR Codes

Traditional Secure Email Gateways inspect incoming messages by analyzing text bodies, evaluating embedded URLs against web-reputation databases, and sandboxing executable attachments. UAT-11764 completely circumvents these inspection engines by encapsulating its malicious call-to-action inside portable document format (PDF) attachments.

The attackers deploy automated engines to generate highly customized PDF files tailored specifically to the targeted individual and enterprise. Inside these documents, the primary interaction mechanism is an embedded graphic image of a QR code. Because the malicious destination URL exists purely as a two-dimensional matrix barcode image rather than clickable HTML text or hyperlinked metadata, standard SEG textual parsers fail to extract or analyze the target address. The email message itself contains harmless, professional language—often mimicking routine corporate operations such as HR benefits updates, secure document sharing, or payroll verifications—allowing the email to pass standard domain-based security checks like SPF, DKIM, and DMARC unflagged.

Phase 2: Abuse of Legitimate Cloud Hosting Infrastructure

When a targeted employee scans the embedded QR code using a mobile device, the embedded matrix resolves into a link hosted on legitimate, top-tier cloud services. UAT-11764 frequently leverages enterprise Microsoft 365 resources, including SharePoint, OneDrive, and Azure-hosted endpoints, to host their initial landing pages.

This tactical choice creates a critical dilemma for web filtering solutions and Next-Generation Firewalls (NGFWs):

• Reputation Bypasses: Secure web gateways automatically assign high domain-reputation scores to official Microsoft and cloud-provider domains, allowing incoming traffic without challenge.
• Device Decoupling: Because employees typically scan QR codes using personal or corporate mobile devices, the subsequent navigation often bypasses endpoint detection and response (EDR) agents configured strictly on desktop workstations.
• Dynamic Redirection: The initial cloud landing page acts as an intermediary redirector, serving a seamless transition to the adversary’s credential harvesting proxy.

Authentication Abuse and Adversary-in-the-Middle (AitM) Execution

According to Cisco Talos data for Q2 2026, authentication abuse was observed in 65% of all investigated engagements, representing a staggering increase from 35% in Q1. This surge directly mirrors the technical capabilities embedded within UAT-11764’s post-scan infrastructure.

Capturing static usernames and passwords is no longer sufficient for adversaries targeting modern organizations protected by MFA. To overcome these security controls, UAT-11764 leverages Adversary-in-the-Middle (AitM) reverse-proxy frameworks. When the victim interacts with the fake login portal, the AitM proxy simultaneously communicates in real time with the legitimate Microsoft 365 authentication server.

1. The user inputs their primary credentials into the proxy interface.
2. The proxy relays these credentials to the real authentication endpoint and triggers an MFA challenge (such as a push notification or time-based one-time password prompt).
3. The user completes the MFA verification on their mobile device or workstation.
4. The AitM proxy intercepts the resulting Session Token and Primary Refresh Token (PRT), granting the attacker fully authenticated access to the target’s M365 suite without ever needing the victim’s plaintext password.

In scenarios where legacy MFA prompts are enforced, threat actors supplement AitM operations with MFA fatigue attacks—flooding the user with repeated push notifications until approved—or by enrolling adversary-controlled devices directly into the victim’s identity profile. Furthermore, threat research highlights the rise of specialized Phishing-as-a-Service (PhaaS) platforms, such as ARToken, which expose dozens of API endpoints specifically engineered for OAuth device code abuse, PRT persistence, and automated SharePoint data extraction.

Automated Self-Propagation and Persistence

Once UAT-11764 establishes an authenticated session within a victim’s Microsoft 365 account, the threat group executes an automated script designed to achieve two primary objectives: operational stealth and rapid lateral propagation.

To eliminate visibility and hinder detection, the compromised account automatically creates malicious inbox rules. These rules are configured to monitor incoming emails for specific keywords—such as “phish,” “security,” “suspicious,” “hack,” or internal security alert subject lines—and instantly redirect those messages to hidden folders (e.g., RSS Feeds, Deleted Items, or custom archive folders) before permanently deleting them. This effectively blinds the victim to warning messages sent by concerned colleagues or internal Security Operations Center (SOC) teams.

Simultaneously, UAT-11764 extracts the user’s complete Global Address List (GAL) and personal contact directory. Utilizing the trust inherent in a legitimate corporate account, the automated system dispatches personalized emails containing new, custom-generated PDF attachments embedded with QR code phishing links to internal team members and external business partners. Because the emails originate from a valid, authenticated internal sender with intact email authentication headers, organizational recipient gateways process the messages as trustworthy internal communications. This automated worm-like capability enables UAT-11764 to scale exponentially across supply chains within hours.

Why Legacy Email Security Fails Against Modern Quishing

The rise of UAT-11764 highlights fundamental limitations in legacy security architectures. For decades, enterprise defenses relied heavily on deterministic gateway scanning and static perimeter controls. However, advanced QR code phishing directly exposes the architectural blind spots of traditional Secure Email Gateways:

• Image Processing Gaps: standard SEGs are optimized for text and code analysis; optical character recognition (OCR) engines that can parse complex vector graphics embedded inside nested PDF layers are resource-intensive and often absent in standard inline gateway configurations.
• Mobile Out-of-Band Redirection: QR codes encourage users to switch devices, moving the interaction from a managed, monitored corporate workstation to an unmonitored personal smartphone connected to cellular data.
• Trusted Domain Abuse: traditional web reputation filters struggle when malicious actors host staging content on verified, enterprise-grade cloud providers like SharePoint and Microsoft 365.

Strategic Enterprise Defenses and Tactical Mitigations

To mitigate the risk posed by UAT-11764 and similar modern quishing threats, security leadership must implement a layered defense posture that spans email inspection, identity controls, and post-compromise behavioral analytics. Cisco Talos recommends several critical defensive measures:

1. Advanced PDF and Visual Payload Inspection

Security engineering teams should configure inbound mail policy rules to quarantine or aggressively flag external emails containing PDF attachments with embedded QR codes. Modern email security platforms must be upgraded with deep OCR capability capable of rendering PDF image layers, extracting encoded QR matrix URLs, and performing dynamic sandbox detonations on the underlying destinations prior to inbox delivery.

2. Mandatory Enforcement of Phishing-Resistant MFA

Because AitM proxies easily defeat traditional SMS, voice-call, and standard push-notification MFA methods, organizations must transition to phishing-resistant authentication protocols. Implementing FIDO2 / WebAuthn hardware tokens or passkeys binds the authentication challenge directly to the verified cryptographic domain origin in the browser, completely blocking AitM proxy relay attempts.

3. Automated Detection of Mailbox Rule and Cloud Anomalies

Defenders must deploy real-time behavioral monitoring across cloud identity environments. Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) platforms should be configured with automated detection triggers for:

• Anomalous Inbox Rules: alerts for any rule that automatically deletes incoming mail, moves messages to obscure system folders, or filters based on security-centric keywords.
• Unexpected SharePoint Staging: sudden spikes in document creation, mass link sharing, or unusual file staging activities originating from newly authenticated sessions.
• Identity Session Deviations: impossible travel detections, concurrent sessions across disparate geographic regions, or unexpected user-agent switching following an OAuth token grant.

By shifting from passive perimeter filtering to active, identity-centric behavioral defense, enterprises can effectively neutralize the evasion mechanics of UAT-11764 and build long-term resilience against evolving quishing techniques.