The payload-less inbox: quishing, SVG smuggling, and the lure with nothing to scan

Email security was built to answer one question: is there anything bad in this message? The newest attacks win by making the honest answer "no." The QR code is just an image. The attachment is just a picture. The HTML file is empty until your browser fills it in. And the writing is flawless, because a machine wrote it.

For twenty-five years, email defense has been a matching problem. A gateway scans the attachment against a list of known-bad file hashes, checks the links against a list of known-bad domains, and flags the obvious impersonation. When there is a malicious artifact in the message, this works. The entire strategy rests on one assumption: that the dangerous thing is present, in the email, at the moment of delivery, in a form the scanner can read.

Every technique in this briefing is a way to break that assumption. They don't defeat the scanner by being cleverer than it — they defeat it by removing the thing it was built to find. The malicious URL becomes a picture of a QR code. The payload becomes a script the browser assembles after delivery. The landing page hides behind a CAPTCHA that only lets humans through. What arrives in the inbox is, by every signature-based measure, clean. We call it the payload-less inbox, and it is where email crime is heading.

1. Quishing: the link that isn't text

A phishing filter reads the links in a message and checks each one. Quishing — QR-code phishing — defeats that by never putting a link in the message at all. The destination is encoded in a QR-code image, and increasingly the image isn't even in the email body but inside an attached PDF, so the scanner has to first open the document, then run computer vision on a picture inside it, to find a URL to check. Most email gateways do neither.

The second move is subtler and worse. A QR code is designed to be scanned with a phone. So the moment the victim raises their camera, the attack jumps from the managed corporate laptop to a personal mobile device — off the corporate network, past the web proxy, beyond the reach of endpoint protection, onto a small screen where the address bar is short and the security cues are faint. The destination is very often an adversary-in-the-middle page that harvests the login and the MFA token.

The numbers track the shift. Barracuda reported detecting over 500,000 PDF-embedded QR phishing emails in 2024, with Microsoft 365 spoofed in about half and roughly 90% aiming at credential theft. Abnormal Security reported QR attacks up 400% from 2023 to 2025. And attackers keep iterating: in 2025 Barracuda documented split and nested QR codes — the payload fragmented across multiple images so that no single one decodes to anything a scanner would flag. (Barracuda; Abnormal Security.)

2. SVG attachments: the picture that runs

Here is a fact most people — including many defenders — find surprising: an SVG file is not really an image in the way a JPEG is. It's an XML document, a set of instructions the browser executes to draw graphics. And that document can legally contain <script> tags and embedded HTML. Which means an .svg attachment can carry working JavaScript that, the moment it's opened in a browser, renders a pixel-perfect fake Microsoft 365 login form or silently redirects to a phishing site.

The evasion is that the whole security industry — and every user — has been trained to think of an image attachment as harmless. Many gateways classify .svg by its image MIME type and never detonate it, the way they would a .docm or an .exe. So the active content sails through.

Attackers noticed. KnowBe4 measured malicious SVGs rising from 1.9% to 6.6% of all malicious attachments in a single quarter in early 2025 — a roughly 245% jump — peaking at nearly 30% of malicious attachments on one day in March. VirusTotal found a batch of 44 SVG samples with zero detections across antivirus engines, each carrying a Base64-encoded phishing page. Sophos and the SANS Internet Storm Center both shipped fresh detection guidance as the trend broke. Much of the surge traces to phishing-as-a-service kits swapping to SVG as a delivery wrapper once HTML and QR attachments started getting flagged more often. (KnowBe4; VirusTotal via The Hacker News; Sophos; SANS ISC.)

3. HTML smuggling: the trap your browser builds

HTML smuggling is the most elegant of the three, and the hardest to catch, because it turns the victim's own browser into the delivery mechanism. The attachment is an ordinary-looking .html file. Opened in isolation, the raw file contains nothing malicious — no bad link, no embedded executable, nothing to match a signature against. What it contains is JavaScript and a block of encoded data.

When the victim opens the file, the browser runs the script, which decodes that data — typically with atob() — and reassembles it into a Blob or data-URI, constructing the malicious file or a full fake-login page locally, in memory, after delivery. The gateway saw a static HTML file and a string of gibberish. The dangerous artifact only ever existed on the victim's machine, assembled by the victim's own browser, leaving — as researchers put it — "no file on disk, no cache artifact, no suspicious HTTP request" for a network defender to see. The technique is formally tracked by MITRE ATT&CK as T1027.006, and the 2024 BlobPhish campaign used exactly this method against Microsoft 365 and US bank credentials. (MITRE ATT&CK; LevelBlue SpiderLabs.)

4. The infrastructure of evasion

Two supporting techniques make all of the above far more effective, and they're worth naming because they defeat the defenses teams most trust.

CAPTCHA and Turnstile gates. Before the phishing page loads, the victim hits a human-verification challenge — often a real or faked Cloudflare Turnstile. Its purpose is not to stop you; it's to stop automated analysis. A security sandbox or crawler that follows the link gets the challenge and a benign holding page; a real human browser, with the right fingerprint, geolocation, and no incognito flags, is passed through to the actual credential-harvesting kit. Some campaigns use the fake Turnstile purely as a traffic filter, deciding in real time whether a given visitor is worth attacking. The result: even when a defender's tooling does follow the link, it often sees nothing wrong. (Netskope; malwr-analysis.)

Trusted-service abuse. The initial link frequently points at a genuinely reputable service — a real DocuSign envelope, a real SharePoint or OneDrive share, a Dropbox notification, a file on trusted cloud storage. The notification email really does come from the provider's legitimate infrastructure, with valid DMARC and a spotless domain reputation, so reputation-based filters wave it through. Cofense found online-document hosts made up a meaningful share of 2024 credential-phishing, with Dropbox the single most-abused; Check Point tracked roughly 40,000 phishing emails disguised as SharePoint and e-signing notifications. The malicious step is one click deeper, on a page the reputable service is unwittingly hosting or pointing to. (Cofense; Check Point.)

5. AI took away the last tell — and the last fallback

For years, the advice for spotting a phish included "look for bad grammar and odd phrasing." Generative AI has retired that advice. An attacker can now produce fluent, correctly branded, individually personalized lures at scale, in any language, in seconds. Microsoft's 2025 Digital Defense Report found that AI-generated phishing emails achieved a 54% click-through rate versus 12% for manually written ones — about 4.5× more effective — and described AI-driven phishing as the single most significant change in phishing over the prior year. The spelling mistakes we taught a generation of users to watch for are simply gone. (Microsoft Digital Defense Report 2025.)

Worse, AI is dismantling the fallback control we always reached for when an email looked suspicious: "pick up the phone and verify with the person." In February 2024, a finance employee at the global engineering firm Arup was invited to a video call with what appeared to be the company's CFO and several colleagues. Every other participant was an AI-generated deepfake, built from public footage. Reassured by the faces and voices, the employee authorized 15 transfers totaling about $25.6 million in a single day. The lesson is stark: a familiar face and voice on a screen are no longer proof of identity. (CNN; World Economic Forum.)

6. Thread hijacking: borrowing a real conversation

The final technique needs no fake anything. Once an attacker has access to a real mailbox — often via the token theft described in our AiTM briefing — they simply reply inside an existing, legitimate email thread. The message inherits the real sender, the real history, the real subject line, and usually a clean DMARC pass. Every reputation and novelty signal a filter relies on says "this is a known, ongoing, trusted conversation," because it is. Proofpoint has tracked over 90 million malicious messages using this technique across five years; Barracuda measured conversation hijacking up 70% since 2022. It is the natural endgame of the payload-less philosophy — the most trusted possible container, with the con delivered as plain words. (Proofpoint via Krebs on Security; Barracuda.)

Why the whole class defeats legacy defense

Step back and the common architecture is clear. Traditional email security is, at heart, a matcher: known-bad hashes, known-bad domains, known-bad phrases. Each technique above removes the artifact that matching depends on.

There is nothing static to hash, nothing static to blocklist, and — with AI — no reliable human tell to train users on. The question "is there anything bad in this message?" has been engineered to return "no." So the defense has to ask a different question.

The defense: stop matching, start reading intent

The strategic shift is from signature to intent and behavior. Instead of asking "does this artifact match known evil?", modern detection asks "what is this message trying to get the recipient to do, and does that make sense from this sender, in this context?" A message that is a first-time request to change banking details, or a QR code pointing to a newly registered domain, or an SVG that renders a login form, is suspicious because of what it is trying to accomplish — regardless of whether any part of it matches a blocklist.

Concretely, a defense fit for the payload-less inbox does these things:

• Decodes and follows QR codes. Extract the QR from the body and from inside attachments, resolve the destination through its full redirect chain, and judge where it actually lands — don't treat an image as unscannable.
• Treats SVG and HTML attachments as active content. Inspect, detonate, or strip them; flag SVGs that contain scripts and HTML that reconstructs data with atob()/Blob/data-URIs. An image that carries code is not an image.
• Detonates behind CAPTCHA gates. Use analysis tooling that can pass a Turnstile-style challenge to reach and evaluate the real landing page, not the decoy.
• Reads intent with language models. Classify what the message asks for — credential entry, a wire, a bank-detail change, an urgent secret — and weigh it against the sender relationship, not just the sender's reputation.
• Enforces DMARC at p=reject plus display-name and lookalike-domain checks, so brand and executive impersonation is caught even when the writing is flawless.
• Distrusts newly registered domains and scrutinizes links behind trusted-service notifications rather than allow-listing the sender outright.
• Watches for the account-takeover fingerprints — new inbox rules, OAuth grants, forwarding changes, mid-thread sender/device shifts — that precede thread hijacking.
• Gives users one-click reporting wired to automated triage, so the time from "this looks off" to containment is minutes, not days.

What to do

1. Assume "clean" from a signature filter is incomplete. Add detection that decodes QR codes, inspects SVG/HTML attachments as active content, and reads message intent — not just known-bad matches.
2. Enforce DMARC at p=reject with display-name and lookalike-domain protection, and distrust newly registered domains.
3. Train people on the new shapes: a QR code in an unexpected email is a link; an "image" or "document" attachment can be active; flawless writing is not proof of legitimacy.
4. Make out-of-band verification mandatory for any payment, bank-detail, or credential request — on a known channel, with a challenge the real person can answer and a deepfake cannot.
5. Give everyone a one-click report button and a no-blame culture around using it, so suspicious mail is triaged fast.
6. Watch the account, not just the inbox — new forwarding rules, OAuth grants, and mid-thread anomalies are how the payload-less attack persists and spreads.

Related reading

• How to analyze a suspicious email header — the forensics that expose a spoofed sender even when the message body is flawless.
• The BEC prevention checklist — the out-of-band verification process that stops the wire, deepfake or not.
• The twelve categories of email threat we screen for — the whole surface of a dangerous inbox, in plain English.

Written by the Family Sentinel security desk — a working Security Architect and the team who watch business and family inboxes around the clock. Sources: Microsoft Threat Intelligence (email threat landscape, 2026; Digital Defense Report, 2025); Barracuda (QR-code and split/nested-QR threat spotlights); KnowBe4 and VirusTotal (malicious SVG analysis); Sophos and SANS Internet Storm Center (SVG detection); MITRE ATT&CK T1027.006 and LevelBlue SpiderLabs (HTML smuggling); Cofense and Check Point (trusted-service abuse); Proofpoint and Krebs on Security, and Barracuda (thread hijacking); CNN and the World Economic Forum (the Arup deepfake case). Figures are as reported by the cited source for the year noted. Have a suspicious message you'd like a verdict on? Forward it to security@familysentinel.org — no charge, no strings.