Blurred PDF Invoices With QR Codes: HP Wolf's Quishing Warning

Your accounts-payable inbox has a new kind of invoice to be suspicious of. On September 17, HP released its September 2026 HP Wolf Security Threat Insights Report, and one of its findings is aimed squarely at the people who open PDFs all day: invoices with the document blurred out and a QR code on top, according to HP, Help Net Security and Security MEA.

The idea behind it is simple: get the target off the protected office PC and onto a phone. Here's how the scam works, why it matters for your office scanner and shared inboxes, and what to tell the people who pay your bills.

What did HP's September threat report find?

The report reviews campaigns HP Wolf Security saw in its customer telemetry during the second quarter of 2026, April through June, per HP's threat research team and Help Net Security. For most offices, the headline is QR-code phishing hidden in PDF invoices.

The report also covered a fake "AI crypto trading agent" spreading an info-stealer called Needle Stealer, and a new malware loader named Phantom Gate. We'll get to those briefly below.

How does the blurred-invoice QR scam work?

The email carries a PDF presented as an invoice, but the content is blurred, supposedly "for security," and a note tells the recipient to scan a QR code with their phone to see it. That's QR-code phishing, better known as "quishing," according to HP, Help Net Security, Cyber Magazine and GSMDome.

Here's the chain, step by step, based on HP's findings and Help Net Security's write-up:

Why do scammers want you on your phone?

Because a phone usually has fewer defenses than a managed work PC. HP says moving the victim onto a smartphone sidesteps the protections guarding a work computer, so a scam link already blocked on the PC can open freely on the phone. Help Net Security notes that a work PC may have email gateways and browser protections that already block a known phishing domain.

In other words, your email filter can do its job on the PC while the QR code simply walks around it. "We have spam filtering" isn't a complete answer to this one.

Where do office printers and scanners come in?

A QR code doesn't care whether it's on a screen or on paper. Printing a suspicious invoice, or scanning a paper one into a shared folder, keeps the same code pointing to the same site. That makes the office MFP and its scan-to-email workflow part of the story:

• Printing doesn't disarm it. If someone prints the "invoice" to deal with later, the printed QR code still leads to the same phishing page, now sitting in a paper inbox.
• Scan-to-email and scan-to-folder copy it. Once a document with a QR code is scanned into a shared folder or sent to a shared mailbox, everyone with access has a copy of the code.
• Shared inboxes multiply the odds. An invoice sent to a shared billing or payables address lands in front of several people, and it only takes one of them to scan it.
• "From the scanner" isn't proof. Our post on how attackers abuse Microsoft 365 Direct Send, one of the ways a scanner can send scan-to-email through Microsoft 365, explains how phishing can be made to look like it came from inside your own organization. A "scanned invoice" that seems to come from your own copier deserves the same QR-code rule.

For more on keeping scanned and printed documents under control, see our secure document printing guide.

What else was in HP's report?

Two items worth a quick look, even if nobody at your office trades crypto:

• A fake "AI crypto trading agent." Attackers advertised it to spread Needle Stealer, which scans the browser for crypto-wallet extensions such as MetaMask and Coinbase Wallet and swaps them for malicious lookalikes that capture the wallet password, per HP, Help Net Security and Netzwoche.
• Phantom Gate. HP identified a new malware loader by that name that appears to extend the Phantom Stealer campaign, according to HP, Cyber Magazine and IT Brief.

The office takeaway: staff shouldn't install "AI assistants" or trading tools on work PCs, and everyday accounts shouldn't have the admin rights that make installing them easy.

What this means for San Fernando Valley offices

Any Valley business that pays vendors by invoice should take this one seriously, from law firms and medical billing offices to property managers and production accountants. Nothing about this trick is tied to one region: an emailed invoice reaches a Woodland Hills bookkeeper as easily as anyone else.

The weak points are the ones most small offices share: one or two people who handle payables, a shared inbox, a scanner that emails PDFs, and personal phones that double as work devices. None of that needs expensive tools to fix. It needs a clear rule, a phone call before paying anything unusual, and a scanner and mailbox setup that doesn't hand every document to everyone. Our checklist of printer security features for small businesses is a good companion, and we work with offices across the San Fernando Valley communities we serve.

What to do now

1. Make it a written office rule: never scan a QR code that arrives inside an emailed invoice or document. To view a real invoice, sign in to the vendor's portal from a saved bookmark or call the vendor at a number you already have.
2. Treat "blurred for security, scan to view" PDFs as phishing. Don't forward them to coworkers; report them to whoever handles IT, then delete them.
3. Verify invoices, and especially any change to payment or bank details, by calling a known contact at the vendor.
4. Turn on multi-factor authentication for every Microsoft 365 account, using phishing-resistant methods where possible, and include phones used for work email in your security policies.
5. If someone scanned the code and entered a password, change it right away from a trusted computer, and have IT sign that account out everywhere and review its MFA methods and mailbox rules.
6. Tighten scanning workflows: limit who can reach the shared payables mailbox and scan folders, and restrict the MFP's scan-to-email to internal addresses where possible. Email authentication (DMARC, SPF and DKIM) also makes your domain harder to spoof; our sister site StopSpoofingMe specializes in it.
7. Only install software from known vendors, and keep everyday accounts off local admin.

Want help locking down scan-to-email and your MFP's settings? Book a free virtual consultation and we'll review your setup with you.