Last updated: 02 October 2026
Scan with Caution
For years, our defences against phishing have focused on the familiar. We scan URLs, filter spam from our inboxes, and train ourselves to spot suspicious links by eye. But attackers keep changing tactics. They keep finding new ways to exploit our trust in everyday technology. Their latest trick? QR code phishing, sometimes called quishing. It targets a device most phishing tools ignore: the phone in your pocket.
The Unseen Threat: QR Code Phishing
A recent incident brought to light a particularly sophisticated phishing threat, cloaked behind the seemingly innocuous facade of a QR code. This malicious campaign began with an email-delivered document purporting to be an unpaid invoice, a lure chosen precisely because invoices carry a sense of urgency and routine that discourages close scrutiny. To access supposedly redacted information, the document prompted users to scan a QR code.
Unlike URLs, QR codes are often given a free pass by traditional phishing protection systems, which are not designed to scan a code’s embedded content for threats. This oversight, combined with the absence of a visible URL, means users may never question the legitimacy of the code. There is nothing to hover over, nothing to read, and nothing that looks obviously wrong, which makes the scam far more difficult to detect at first glance.
Unfolding the Scam
Those who scanned the QR code were redirected to a Cloudflare verification page, a common tactic used by threat actors to thwart both dynamic and static analysis by security systems. This step requires human interaction, and that single requirement does a great deal of work for the attacker. Automated crawlers and sandboxes cannot easily click through it, so the phishing site remains under the radar of automated defences for longer than it otherwise would.
Upon navigating the Cloudflare hurdle, users encountered a fake Microsoft login page asking them to enter their credentials. This is a classic phishing move designed to steal sensitive information. Because the page mimicked a service the victim already trusted and used daily, many would enter their username and password without a second thought, handing the attacker exactly what they were after.
The Takeaway
This incident is a stark reminder of the continuous need for vigilance, and of the importance of extending security protections to all endpoints. Attackers are increasingly exploiting the often lacklustre protection on mobile devices, spotting a gap they can exploit. Desktops and laptops tend to sit behind layered corporate defences, whereas phones frequently do not, and that imbalance is precisely what this campaign was built to exploit. QR codes, offering convenience and efficiency, have become a double-edged sword, providing cybercriminals with new opportunities to launch their attacks.
Corrata’s security solution immediately identified the threat posed by the newly registered domain. Our Zero Day Protection swiftly blocked the suspicious domain and alerted the administrators. Upon further analysis, the domain was reclassified as a phishing site.
The Evolution of QR Code Phishing
The lure in this campaign was a straightforward QR image sitting in a PDF. Attackers have since moved on to constructions built specifically to defeat the scanners that eventually learned to read them. Barracuda documented split QR codes in 2025, where the payload is fragmented across several images or pages so that no single element decodes to anything meaningful, and nested codes concealed inside other visual layers.
More awkward still are Unicode block-character constructions, which render a scannable pattern out of text characters rather than an image, so there is no picture for an image-based decoder to find in the first place.
Others simply change the container: one campaign in early 2026 hid encoded phishing URLs inside BMP attachments, which passed SPF, DKIM and DMARC and reached inboxes with the payload structurally invisible to every text-based control in the delivery path.
The pattern holds across all of them. Whatever the gateway has learned to parse, the next iteration puts the URL somewhere it is not looking, and the phone camera decodes it regardless.
How to Protect Yourself from QR Code Phishing
Defending against quishing does not require exotic tools so much as a shift in habits and a widening of coverage to the mobile device. A few practical measures go a long way.
Treat unexpected QR codes with the same suspicion you would give an unexpected link. If a code arrives in an email, particularly one attached to an invoice, a delivery notice, or a payment request, pause before scanning. Ask whether you were expecting it and whether the sender is who they claim to be.
Preview the destination before you commit. Most modern phone cameras display the underlying URL when they detect a code. Read it carefully, watch for misspelled brand names or odd domains, and do not proceed if anything looks off.
Never enter credentials on a page reached through a scanned code. Legitimate services rarely, if ever, ask you to log in this way. If you genuinely need to access an account, close the page and navigate to the site directly through your browser or app instead.
Enable multi-factor authentication wherever it is offered. Even if an attacker captures your password on a convincing fake login page, a second factor gives you a crucial extra layer of defence that can stop the intrusion in its tracks.
Extend security to mobile. The core lesson of this campaign is that the phone is now a front line. Endpoint protection that inspects the content behind a QR code, rather than merely the visible parts of a message, closes the gap that these attacks depend on.
Stay ahead of Cybercriminals
Corrata’s Mobile Security solution continues to monitor and defend against the ever-changing tactics of cybercriminals. By understanding the methods that attackers use, and by implementing advanced security measures across every device rather than only the traditional ones, we can stay one step ahead.
