> - QR codes are disproportionately effective at bypassing most anti-spam
filters, as most filters are not designed to recognize that a QR code is present
in an image and decode the QR code. According to Talos’ data, roughly 60% of all
email containing a QR code is spam.
> - Talos discovered two effective methods for defanging malicious QR codes, a
necessary step to make them safe for consumption. Users could obscure the data
modules, the black and white squares within the QR code that represent the
encoded data. Alternatively, users could remove one or more of the position
detection patterns — large square boxes located in corners of the QR code used
to initially identify the code’s orientation and position. > - Further
complicating detection, both by users and anti-spam filters, Talos found QR code
images which are “QR code art”. These images blend the data points of a QR code
seamlessly into an artistic image, so the result does not appear to be a QR code
at all.