QR Code Phishing (Quishing): What it is and How to Stop it
Last updated on 11 August 2026
QR code phishing, usually shortened to quishing, arrives addressed to one security team and lands on a device looked after by another. The message comes in through email, where inspection is heaviest. But the scan happens on a phone, which in most organisations sits outside the controls protecting everything else. Neither team is being careless. The technique crosses a boundary that most security programmes were not built to cover.
That boundary is what keeps quishing worth an attacker’s time, and it explains why treating it as an email problem tends not to resolve it.
What is quishing?
Quishing is phishing in which the malicious link is hidden inside a QR code rather than written as text. The attacker delivers a code by email, in a message, or on something printed, and the recipient scans it with a phone camera. The code resolves to a web address the recipient cannot read in advance, usually a counterfeit login page built to capture credentials. The objective is the same as any credential phishing attack. What changes is the delivery, and that change matters, because a QR code is an image, so a tool that inspects text does not see a link at all.
The word is a contraction of QR and phishing. Some practitioners object to it on the grounds that it describes ordinary phishing with an extra step, which is fair as taxonomy. The distinction still earns its keep operationally, because the controls that catch a text link are not the controls that catch an image.
The security risks of QR codes
A QR code is a two-dimensional barcode that resolves to a web address when scanned. Two properties of that design are what an attacker makes use of:
The destination is not visible on the code: There is no text to inspect, so nobody can tell where a code leads before scanning it. Most phone cameras will preview the resolved address before the page opens, which helps, but the preview arrives after the decision to scan has already been taken.
The code cannot be verified: QR codes are not signed or encrypted by default, so nothing distinguishes an original from one that has been altered or replaced. A tampered code looks the same as an untampered one.
Together those properties mean the usual advice does not transfer. An employee trained to hover over a link and read the domain before clicking has no equivalent move available. There is nothing to hover over and nothing to read. The check has to move to the moment the page opens, rather than the moment before the scan.
The same properties that defeat the human check also defeat the automated one.
Why quishing gets past email security
Secure email gateways were built to parse text. They read headers, body copy and addresses, then check what they find against reputation data. A QR code offers none of that. The destination sits encoded in pixels, and unless the gateway renders the image and decodes it, there is nothing for the engine to match against.
Cyble’s research team tracked one quishing campaign, which it named Scanception, and identified more than 600 unique phishing PDFs and emails over three months. Nearly 80% of the PDFs it examined had no detections at all on VirusTotal at the time of analysis.
Attachments make this harder still. A code inside a PDF is an image inside a file, two removes from a text scanner. Cyble also observed lures that grew from a single page to several, which defeats tools configured to inspect only the opening page of a document.
We take that evasion chain apart step by step in how QR codes evade email security gateways.
Where the code comes from
Four delivery patterns account for most of what we see.
In an email attachment: This is now close to the whole picture for email-delivered codes, and the file type keeps moving. Microsoft found PDFs carrying 79% of QR code attacks in April 2026, falling to 58% by June, while Word documents rose to 40% over the same period. It notes that operators have swapped between the two formats repeatedly across the past year. Codes placed directly in the email body went the other way, surging in March to 5% of attacks and then falling to near zero across the second quarter.
That rotation is worth dwelling on, because it is an argument against detection tuned to a file format. A control that learned to open PDFs in April was looking in the wrong place by June. The pretext is steadier than the container: something routine carrying mild urgency, such as an unpaid invoice, a payroll notice or a document said to need review. Routine is the point, because it discourages close reading.
Pasted over a legitimate code: Because a printed code cannot be verified, replacing one is a matter of a sticker. Parking meters, menus and posters have all been used this way.
On a screen, to move the target onto a phone: Codes increasingly appear on desktop displays as a way of linking a computer session to a mobile one. Signing in to WhatsApp on a laptop works this way. Attackers use the same handoff to get a session onto a device with weaker controls.
In messaging apps and SMS: A code sent as an image in a chat inherits the trust of the channel and of the sender, particularly where the sender’s own account has been taken over.
Why the phone is where this lands
A corporate laptop generally sits behind a firewall, DNS filtering, a web proxy and endpoint detection, with conditional access governing what it can reach. A phone often has none of that, and a personal phone used for work almost never does.
Microsoft’s assessment is that the scan tends to move the victim onto a mobile device the organisation does not manage, and that this is part of why QR codes have become a favoured tool for actors trying to get past email defences. Cyble noted that Scanception moved the point of compromise onto unmanaged mobile devices, outside the corporate perimeter. That is not incidental to the attack. It is the reason the attack is built this way.
Two smaller factors compound it. A decade of legitimate use has trained people to scan without deliberating. And a handset shows less of an address than a monitor does, so a lookalike domain that would stand out on a desktop can pass unremarked.
Why multi-factor authentication does not close the gap
Where the counterfeit page operates as an adversary-in-the-middle proxy, it relays the login in real time. The password and the second factor both pass through to the genuine service, and the attacker retains the resulting session token.
Cyble observed adversary-in-the-middle pages in the Scanception campaign. Multi-factor authentication still raises an attacker’s costs and should stay switched on, but it does not by itself answer this technique.
How to defend against quishing
Two layers, and the second is the one most organisations are missing.
What people can do: Treat an unexpected code the way you would treat an unexpected link, and pause before scanning one that arrives with an invoice or a payment request. Read the address your camera previews before opening it. Decline to enter credentials on any page reached by scanning, and navigate to the service directly instead. On printed codes, look for a sticker edge or a raised corner.
What controls can do: Awareness alone leaves the outcome resting on one person’s judgement at one moment. Closing the gap means inspecting traffic on the device where the code opens. Corrata inspects that traffic on the phone itself, filtering against mobile-specific phishing intelligence. Previously unseen domains are quarantined until their reputation can be established, which is what catches a domain registered hours before a campaign starts. Detections raise an alert to the security team through the organisation’s existing SIEM.
Read more about blocking malicious links behind scanned QR codes, or see the sequence play out in a compromised supplier account used to deliver a QR code.
In the demonstration above, a scanned code opens a counterfeit of the eBay sign-in page, distinguishable from the real one only by its address. With Corrata running, the page does not load and the user is told a threat was detected.
See this on your own devices
The same inspection applies to any scanned code, whether it arrives in an attachment, in a message, or on something printed. If you want to see how it behaves on your organisation’s phones, get in touch.
Frequently asked questions
What is quishing?
Quishing is phishing that hides the malicious link inside a QR code instead of writing it as text. The victim scans the code with a phone and lands on a counterfeit page, usually one built to capture login credentials.
Is quishing different from phishing?
The objective is identical. Only the delivery differs. Because the link is an image rather than text, it evades scanning tools that read text, and because it is scanned with a camera it typically opens on a phone rather than a managed computer.
Can email security stop QR code phishing?
Not reliably. Gateways that parse text cannot read an address encoded in an image. Cyble found that nearly 80% of the QR-bearing phishing PDFs in one campaign had no VirusTotal detections at the time of analysis.
Does multi-factor authentication protect against quishing?
It helps but does not settle the matter. A counterfeit page running as an adversary-in-the-middle proxy passes both the password and the second factor to the real service and keeps the session token.
How can I tell whether a QR code is malicious before scanning it?
You cannot read the destination from the code itself, so the check has to happen as the page is about to open. Most phone cameras preview the resolved address first, so read it before proceeding, and treat an unexpected code the way you would an unexpected link. On printed codes, look for signs that a sticker has been applied over the original.
