agent's qr extractor failed on a rotated qr image and the payload url was never submitted for detonation

TL;DR

Normalise the picture before asking the decoder to work: try the image at its stored orientation and at right angle rotations, apply contrast and scaling preprocessing, and decode each attempt until one succeeds, then submit the recovered URL for detonation like any other link. Screenshots and photographed codes arrive rotated constantly, and many decoders only read an upright code, so a single orientation attempt quietly drops the one indicator that made the sample worth triaging.

agent's qr extractor failed on a rotated qr image and the payload url was never submitted for detonation

Use this when

• The agent extracts no URL from a QR phish sample that a phone scans successfully.
• The sample image is a screenshot or photo with the QR code rotated or skewed.
• Other, upright QR samples extract correctly through the same agent.

Not for this skill when

• The QR code points at a benign page and a user misreported it. Extraction succeeding will prove that; do not assume malicious.
• The image resolution is too low for any decoder even after preprocessing. Request a better copy from the reporter.

Steps

1. Reproduce the failure with the sample and record the image dimensions, orientation metadata, and the decoder error or empty result. Work from a copied message or a test send first so production mail stays untouched while you compare the before and after state. Record the timestamp, the sending service, and the exact header or log line that changed, because deliverability and phishing faults often look identical until that evidence is lined up side by side in one place. Verify: the baseline failure and image properties are recorded
2. Add preprocessing attempts in order: orientation from metadata, rotations at right angles, upscale, grayscale and contrast stretch, then decode each variant. Do not change more than one setting at a time here. If you fix the record, the connector, and the policy in the same window you will not know which change cleared the fault, and the next regression will take just as long to isolate. Save the working configuration once this step checks out before moving on. Verify: the sample decodes successfully at one of the preprocessing steps
3. Store which transform succeeded with the case so recurring sender patterns can be anticipated. Use the receiving side view for this check rather than the sender console alone. Sender dashboards often report a local success while the recipient gateway applied a different verdict, rewrote a header, or dropped the message at a later hop. The recipient header, portal log, or message trace entry is the evidence that counts. Verify: the case record shows the successful transform for the sample
4. Submit the recovered URL through the normal detonation path and attach the verdict to the case. Keep any exception you create narrow and time boxed. Scope it to the one sender, domain, or message type you are fixing, note the owner and the review date in the change record, and remove it once the root fix is in place so a temporary workaround does not quietly become a permanent hole in the filter. Verify: the case shows a detonation verdict for the recovered URL
5. Regression test with a pack of QR samples: upright, rotated each way, a screenshot, and a low contrast print scan. Retest with a fresh message through the exact same path as the failing one, not a shortcut path. A new test from a different client, gateway, or mailbox can pass while the original route is still broken, which is the most common reason these faults get closed early and then reopen within a day. Verify: all decodable samples in the pack extract a URL

Why it happens

QR decoders expect finder patterns in a readable arrangement, and while good libraries handle rotation, the thin wrappers agents often use do not, especially once a screenshot has also scaled and compressed the code. Attackers do not rotate codes deliberately; phones and screenshots do it for them, which means the failure correlates with exactly the user submitted samples an agent exists to process. A small preprocessing ladder turns a brittle single attempt into a robust extraction stage.

Variants and edge cases

agent qr extractor failed rotated qr image payload url never detonated

The exact orientation failure wording.

qr code rotated screenshot decode preprocessing rotation agent fix

The preprocessing technique variant.

qr phish sample no url extracted image orientation decoder

The symptom variant from case notes.

Compatibility: QR decoding libraries such as zxing based tools, image preprocessing with common imaging libraries, detonation submission APIs.

Edge cases to check:

• Perspective skew from photographed screens can need a correction step beyond rotation; add it only if your samples show it, with tests.
• Log decode failures with the image saved, because a decoder upgrade later can reprocess the backlog of missed codes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jI5S2AaD-Lri3oWiwITXaA