Attackers are attaching corrupted Microsoft Word documents to phishing emails in a novel attempt to evade email malware prevention mechanisms. Corrupted Word documents bypass email security due to their damaged state but can still be recoverable by Microsoft Word when opened. New phishing campaigns attach these corrupted documents to emails purporting to be sent from an organization’s payroll or HR department announcing information about benefits or bonuses. When the attachment is opened, Microsoft Word will build the document if the user clicks “Yes” to attempt recovery when prompted. The recovered document contains a logo of the target organization along with a QR code users are asked to scan to view the fake benefits or bonus information. The QR code directs users to a phishing site that mimics Microsoft’s M365 log-in page, prompting users to enter their credentials which are subsequently harvested by the attacker. The tactic of attaching a corrupted Word document has thus far proven to be a successful means to evade detection by email security solutions. When uploaded to VirusTotal, these corrupted files return as either “Clean” or “Item Not Found”. CTIX analysts recommend that organizations educate users on these types of attacks and remain vigilant in auditing user authentication patterns and activity. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.