Top 3 Evasion Techniques In Phishing Attacks: Real Examples Inside

Phishing attacks aren’t what they used to be. Hackers no longer rely on crude misspellings or sketchy email addresses. Instead, they use clever tricks to dodge detection tools and fool even cautious users.  

Let’s break down three evasion techniques that are increasingly common in phishing campaigns with real examples pulled from recent ANY.RUN sandbox analyses. 

1. Hiding Malicious Links In QR Codes

Instead of sending a direct phishing link, attackers now embed the link inside a QR code, typically disguised as something harmless, like a login prompt, payment notice, or delivery update.

The email might look clean to scanners, but once the user scans the code with their phone, they’re taken straight to a phishing site. 

Here’s why this tactic is so effective and dangerous: 

• Email filters don’t “see” the link – QR codes are images, and many scanners don’t decode or analyze their content. So even if the embedded link leads to a phishing page, it passes undetected.

• Mobile users are more vulnerable – Scanning a QR code on your phone doesn’t show the full URL like hovering over a link on a desktop might. Most users just tap and proceed.

• The phishing site can look highly convincing – Victims may be tricked into entering credentials, credit card numbers, or 2FA codes, handing attackers access to business email accounts, payment systems, internal networks, personal and corporate data.

Luckily, there are solutions like ANY.RUN sandbox that can handle exactly this kind of evasive trick.

When you upload a phishing email or file containing a QR code, the sandbox automatically detects the image, decodes it, and pulls out the link. 

View analysis session with QR code 

Before starting the session here, we enabled the option “automated interactivity”. This means the sandbox behaves like a real user.

It scans the QR automatically, opens the embedded link in a browser and solved CAPTCHA without your manual intervention.  

See through phishing tricks in seconds. Access ANY.RUN with your 14-day trial and catch what other tools can’t -> Start your 14-day trial now 

As a result, the victim is redirected to a fake Microsoft login page for credentials theft. 

Inside the sandbox, we can see how the entire attack chain is uncovered within seconds, from detecting the QR code to opening the phishing page and labeling the behavior.

The verdict is clear: malicious activity is present. 

ANY.RUN automatically tags key elements of the attack with labels like “QR code,” “phishing,” and even campaign-specific indicators like “Tycoon” when applicable.

This gives analysts instant context without the need for manual digging. 

By exposing the full threat flow in real time, detection time drops from hours to seconds, helping security teams: 

• Quickly validate suspicious emails or files
• Avoid chasing false positives
• Take action before a user falls for the trap

In short, what would normally require deep manual analysis is now surfaced instantly with evidence, labels, and behavior insights all in one place. 

2. Geotargeting And Redirect Chains

Some phishing campaigns don’t show their hand right away. Instead of directly exposing malicious content, they carefully profile the victim first, based on location, browser settings, system details, and more.

If the visitor fits the attacker’s target criteria, they’re quietly redirected to a phishing site. If not? They’re sent somewhere else, such as a Tesla website.  

This technique, often used in campaigns like Tycoon2FA, helps attackers stay hidden and hyper-targeted. 

In a recent Tycoon2FA phishing campaign, this conditional redirection was used to great effect.  

Here’s how it worked: 

The user visits a page (kempigd[.]com in this case) that quietly runs a fingerprinting script in the background.

It collects details like screen resolution, WebGL renderer, plugins, and time zone to determine whether the visitor matches the attacker’s target profile. 

If the fingerprint doesn’t match, the visitor is redirected to a legitimate site, in this case, Tesla’s official website. This helps the phishing page appear harmless during casual or automated inspection. 

View Tesla website rediraction in ANY.RUN 

If the fingerprint does match, the user is silently redirected to a phishing page designed to steal Microsoft 365 credentials. 

View analysis with Microsoft phishing page 

ANY.RUN’s Interactive Sandbox lets analysts quickly change the VM’s IP and other network settings to match the targeted geo to detonate the threat.

This kind of fast analysis saves SOC teams hours of manual investigation by: 

• Showing exactly how and why a redirect occurs

• Revealing phishing attempts that are invisible to standard scanning tools

• Confirming the threat with context-specific behavior tags

3. CAPTCHA Forms To Delay Detection

Phishing pages are becoming more interactive, and not just to mimic real sites. Some now use CAPTCHA challenges as a deliberate evasion step.

These forms are designed to block bots, scanners, and automated security tools from reaching the actual malicious content. 

By placing a CAPTCHA at the front of the attack chain, threat actors can delay detection or even prevent it entirely. 

Here’s how this technique works: 

1. A phishing email or document leads to a seemingly clean link.

2. Upon opening, the user is presented with a CAPTCHA challenge.

3. Only after solving it does the real phishing page load, often mimicking services like Microsoft 365.

View the full sandbox session with CAPTCHA 

To simulate the full flow, we enabled automated interactivity in ANY.RUN. This allowed the sandbox to solve the CAPTCHA just like a real user would, uncovering the next stage of the attack without any manual input. 

As the form is completed, the victim is silently redirected to a fake Microsoft login page.

Notably, the background image also changes, a tactic often used to reinforce the illusion of authenticity and distract from subtle design flaws. 

This type of advanced analysis is important as automated tools usually stop at static analysis. They can’t navigate CAPTCHAs, meaning they never see what comes next. But with ANY.RUN: 

• The full post-CAPTCHA behavior is recorded
• Malicious redirects and phishing logic are uncovered
• Analysts don’t waste time reproducing the flow manually

With one click, teams can validate evasive phishing attempts and move faster on response, without guessing what’s hidden behind that CAPTCHA wall. 

Final Thoughts: Evasive Tactics, Exposed In Seconds

As phishing attacks become more sophisticated, it’s clear that traditional detection methods aren’t enough.

Techniques like QR code obfuscation, geotargeted redirects, and CAPTCHA-based delays are specifically designed to slip past static scanners and waste analysts’ time. 

But with solutions like ANY.RUN’s interactive sandbox, you don’t have to guess or waste hours reproducing complex attack flows. 

• Watch evasive phishing tactics unfold in real time
• Automatically extract indicators like malicious links, domains, or redirection chains
• Detect and tag phishing behavior instantly, no matter how well it’s hidden
• Reduce investigation time from hours to seconds
• Enable your team to respond faster, with full confidence in the verdict

Start your 14-day trial now and experience what real visibility into phishing looks like.