---
title: Hunt: Unit 42 tracked three phishing kits that hide the lure in images, HTML5 canvas and SVG so URL and static HTML scanners see almost no text | ctxsec
url: https://ctxsec.com/items/hunt-unit42-graphics-based-phishing-image-canvas-svg-qr-may-oct-2026
description: "Unit 42 says three campaigns produced about 1,740 detections from May through October 2026 by keeping brand prompts, bank receipts and session-hijacking QR codes out of the DOM. Campaign 1 (1,188 hits) fetches a full verification card as a cloud preview image into a nearly empty page. Campaign 2 (361) paints a blurred bank-transfer receipt on an HTML5 canvas inside a fake PDF.js viewer, then opens a password dialog. Campaign 3 (191) draws QR codes as SVG vector paths on a coordinate grid. Static HTML and URL scanners that only look for form fields and lure words miss all three."
status: "confirmed research (Unit 42 timely threat intel note, Nov 4; X post Nov 5)"
published: 2026-11-04
---

> Unit 42 says three campaigns produced about 1,740 detections from May through October 2026 by keeping brand prompts, bank receipts and session-hijacking QR codes out of the DOM. Campaign 1 (1,188 hits) fetches a full verification card as a cloud preview image into a nearly empty page. Campaign 2 (361) paints a blurred bank-transfer receipt on an HTML5 canvas inside a fake PDF.js viewer, then opens a password dialog. Campaign 3 (191) draws QR codes as SVG vector paths on a coordinate grid. Static HTML and URL scanners that only look for form fields and lure words miss all three.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-unit42-graphics-based-phishing-image-canvas-svg-qr-may-oct-2026.md)

confirmed research (Unit 42 timely threat intel note, Nov 4; X post Nov 5)

2026-11-04

### Hunt: Unit 42 tracked three phishing kits that hide the lure in images, HTML5 canvas and SVG so URL and static HTML scanners see almost no text

- **Hunt / detect:** pages with almost no visible text or `<input>` tags that still show a big 'Continue verification' or receipt preview; HTML that loads PDF.js-style modules then draws a large canvas; SVGs whose path data encodes a QR grid; runtime browser analysis / screenshot OCR rather than DOM string matches alone.
- **Controls:** block or sandbox unexpected HTML attachments and untrusted collaboration-preview links; require phishing-resistant MFA so a captured session from a QR or AiTM page is harder to reuse.

Sources: [Unit 42 timely threat intel: Three Phishing Campaigns Using Graphics-Based Lures (Nov 4)](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-11-04-Phishing-Campaigns-Using-Graphics-Based-Lures.txt) · [Unit 42 on X (Nov 5)](https://x.com/Unit42_Intel/status/2118434702390333624)