Quishing Attacks Are Bypassing Your Email Security — Here's How QR Code Phishing Really Works
Quick Answer: Attackers are hiding phishing links inside QR codes in emails to dodge link scanners and push victims onto unmonitored phones. Never scan an unexpected QR code in an email — verify the sender through a separate channel first.
Last verified: September 6, 2026
A payroll clerk at a mid-sized US logistics firm gets an email that looks exactly like it came from her HR portal. Subject line: "Action Required — Benefits Enrollment Update." No suspicious link to hover over, no shady attachment icon — just a clean, official-looking QR code sitting in the body of the email. She pulls out her personal phone, scans it on her lunch break, and lands on a sign-in page that looks identical to her company's SSO portal. She types her credentials. Nothing visibly breaks. Three days later, IT is chasing down unauthorized mailbox rules and a wave of internal phishing emails sent from her own account.
This isn't a hypothetical. It's the exact pattern security vendors are now seeing at record volume, and it has a name every SOC analyst needs to know cold: quishing.
Table of Contents
- What Is Quishing (QR Code Phishing)?
- Why Quishing Is Exploding Right Now
- Anatomy of a Quishing Attack
- The Numbers: What the Telemetry Actually Shows
- How Analysts Can Detect and Investigate Quishing
- Prevention Strategies for Individuals and Organizations
- Expert Tips From the SOC Floor
- FAQ
- Conclusion
What Is Quishing (QR Code Phishing)?
Quishing is phishing delivered through a QR code instead of a clickable hyperlink. The attacker embeds a malicious URL inside a QR image — placed directly in the email body or inside a PDF attachment — and relies on the victim's phone camera to do the "clicking" for them.
The technique isn't new, but its scale is. According to ESET's H1 2026 Threat Report, quishing has reached record levels in the company's telemetry, a category ESET has only tracked separately since September 2025. Microsoft's own Q1 2026 email threat data reported a 146% quarter-over-quarter jump in QR-based phishing volume, and Palo Alto Networks has logged more than 11,000 malicious QR-code detections daily.
Why Quishing Is Exploding Right Now
Three structural weaknesses make QR codes an unusually efficient phishing vector, and none of them are new — attackers are just combining them more deliberately.
- Text-based filters go blind. A QR code is an image, not a URL string. Legacy email gateways that scan text for known-bad domains often never "see" the destination at all.
- The attack jumps devices. Scanning happens on a phone. That single action moves the victim off a hardened corporate laptop — with EDR, DNS filtering, and browser isolation — onto a personal device with none of it.
- Trust is already built in. QR codes are part of daily life now: restaurant menus, parking meters, event check-ins, MFA setup screens. Surveys from KnowBe4 consistently find that roughly three-quarters of users will scan a QR code without inspecting where it leads.
Attackers are also getting more surgical about delivery. ESET researchers observed a sharp rise in "imageless" QR codes — codes constructed directly from email markup rather than embedded as a static image file — which is specifically designed to slip past defenses that only inspect image attachments.
Anatomy of a Quishing Attack
Real-world quishing campaigns follow a fairly consistent kill chain, according to public threat intelligence from ESET and Barracuda:
- Pretext delivery — an email impersonating HR, IT, a bank, or a trusted SaaS brand (DocuSign and Microsoft 365 are frequently spoofed), often with urgent language about payroll, benefits, or account security.
- QR code placement — embedded in the email body itself, or inside a PDF attachment (Barracuda researchers identified more than half a million phishing emails using this PDF-delivery method over a three-month window).
- Mobile redirect — the victim scans with a personal device and is sent to a spoofed login page mimicking Microsoft 365, a VPN portal, or internal SSO.
- Credential and token capture — some campaigns go further than password theft, harvesting session tokens through OAuth-consent abuse (tracked by ESET as "ConsentFix"), which can hijack an account without ever needing MFA to fail.
- Lateral movement — a single compromised mailbox becomes a launchpad for internal phishing, business email compromise, or broader network access.
The Numbers: What the Telemetry Actually Shows
Per ESET's H1 2026 Threat Report — covering December 2025 through May 2026 — here's the confirmed data:
| Metric | Figure |
|---|---|
| Share of all detected phishing emails containing a QR code | ~11% |
| Average monthly ESET detections | ~100,000 |
| Peak detection month | April 2026 |
| United States share of detections | 19% |
| Spain share of detections | 17% |
| Mexico share of detections | 6% |
Separately, Microsoft's Q1 2026 email threat landscape data reported a 146% quarterly increase in quishing volume, and flagged a sharp rise in QR codes delivered directly in the email body (no attachment) versus earlier PDF-based delivery — a sign the technique is still actively evolving rather than plateauing. Researchers should treat these as complementary datasets from different vendors' telemetry rather than a single unified count, since methodology varies between ESET and Microsoft.
How Analysts Can Detect and Investigate Quishing
Frontline detection depends on decoding the QR payload, not just flagging that an image exists. ESET, for example, tracks these under the signature name QRCode/Phishing, using a dedicated scanning layer that locates QR codes across file types, decodes the embedded URL, and checks it against anti-phishing and anti-malware reputation feeds before the message ever reaches an inbox.
If your team needs to manually triage a suspicious QR image pulled from a reported email, do it in an isolated analysis environment — never on a personal or corporate production device. A quick, safe way to extract the destination URL without visiting it:
zbarimg suspicious_qr_image.pngWhat it does: zbarimg reads a barcode/QR image file and prints the decoded string (the embedded URL) to the terminal — no browser, no network request, no risk of triggering the payload.
When to use it: During SOC triage of a user-reported phishing email, to extract the destination URL for offline analysis before deciding on a block or escalation.
Expected output: A single line of decoded text, typically the malicious URL (e.g., QR-Code:https://example-fake-sso[.]com/login).
Once you have the decoded URL, submit it to a sandboxed lookup service such as VirusTotal or urlscan.io rather than opening it directly — this keeps the investigation fully passive.
Warning: Never open a decoded quishing URL in a live browser session, even out of curiosity. Use an isolated VM or a purpose-built URL sandbox only.
Prevention Strategies for Individuals and Organizations
For individual users:
- Treat an unsolicited QR code in an email exactly like an unsolicited link — don't scan it under time pressure.
- If a scan is unavoidable, inspect the full decoded URL your phone displays before tapping through, and never enter a password or payment detail on a page reached that way.
- Confirm HR, IT, or bank requests through a separate, trusted channel — a known phone number or bookmarked site — not by replying to the same email thread.
For SOC and IT security teams:
- Deploy email security tooling that specifically decodes and inspects QR codes — including those embedded inside PDF and image attachments — rather than relying on text-only URL filtering.
- Extend DNS filtering, conditional access, and phishing-resistant MFA (FIDO2/passkeys) to mobile devices, since that's where quishing is designed to land.
- Run targeted awareness training on quishing specifically; generic phishing training doesn't cover the "scan first, think later" reflex QR codes exploit.
- Monitor for anomalous mailbox rule creation and outbound internal phishing as a post-compromise indicator, since token theft via QR-based OAuth abuse can bypass MFA entirely.
None of these controls offer guaranteed prevention — quishing is evolving specifically to route around existing defenses, so layered detection plus user judgment remains the realistic goal.
Expert Tips From the SOC Floor
- Don't just block the domain after a quishing incident — pull the full decoded URL and check for infrastructure reuse across other reported emails; quishing kits are frequently reused across multiple spoofed brands.
- Flag QR codes that don't match their visual context (a "DocuSign" email with a QR code instead of DocuSign's actual signing button is a strong tell).
- Watch for the OAuth-consent variant specifically — if a "quishing" incident doesn't produce a captured password in your logs, check for a granted app consent instead, since token theft can look like a clean login.
Related Cybersecurity Topics You Should Explore
- Microsoft Teams Won't Load? Inside the TM1466820 Windows Bug
- Why Ad Networks Get Your Blogger Blog Locked (Fix It Fast)
- The touch Command Trick Attackers Use to Fake File Timestamps
- WordPress Now Uses AI to Catch Security Flaws Before Hackers Do
- Mini Shai-Hulud Worm Hits npm Package With 150K Weekly Downloads
- more vs less Linux Commands: The SOC Analyst's Log Review Guide
- JFrog Artifactory Hacked: Attackers Are Minting Admin Tokens
- tail -f Explained: The Linux Command That Beats Your SIEM's Delay
- Brave Browser Now Hides Your Real Email From Every Website
- D-Link Router Flaw Lets Hackers Steal Your Wi-Fi Password
- 'This Blog Has Been Locked' — How to Backup Blogger the Right Way
- cPanel Zero-Day Lets Hackers Seize Root Control of Your Server
- TP-Link Kasa Vulnerability Lets Hackers Hijack Your Smart Home Devices
- CVE-2026-16444: The TeamViewer Bug That Turns File Transfer Into RCE
- Hackers Weaponize Fake Resumes to Hijack PCs Silently
FAQ
Q: Are all QR codes in emails dangerous?
A: No. Legitimate businesses use QR codes for MFA setup, event check-in, and payment. The risk comes from unsolicited codes tied to urgent requests you weren't expecting.
Q: Can antivirus software stop quishing?
A: Traditional antivirus generally can't, since the payload is a phishing page, not malware. Email security that decodes and checks QR URLs before delivery is the more relevant control.
Q: Why do attackers prefer QR codes over regular phishing links?
A: Because QR codes hide the destination from both the user and text-based security filters, and they push the interaction onto a personal phone with weaker security controls.
Q: Does scanning a malicious QR code infect my phone automatically?
A: Usually not by itself — most quishing campaigns rely on you manually entering credentials on a fake login page after scanning, rather than automatic malware installation.
Q: Is quishing linked to nation-state actors?
A: The FBI warned in January 2026 that North Korea-aligned Kimsuky has used malicious QR codes in spearphishing campaigns targeting US organizations, so it isn't limited to commodity cybercrime.
Q: What should I do if I already scanned a suspicious QR code and entered credentials?
A: Change the affected password immediately from a trusted device, revoke active sessions and app consents tied to that account, and report it to your IT/security team so they can check for lateral movement.
Conclusion
Quishing isn't a novel exploit — it's an old social-engineering trick wearing a new format, and it's working precisely because most email security stacks were built to inspect links, not decode images. As ESET's H1 2026 data shows, this isn't a fringe technique anymore; it's a mainstream, growing share of the phishing traffic hitting real inboxes. The fix isn't exotic either: decode before you trust, verify out-of-band, and treat every unexpected QR code with the same suspicion you'd give a shortened link from a stranger.
Have you seen quishing attempts targeting your organization? Share what you're seeing in the comments, and subscribe for more real-world SOC breakdowns like this one.
Analysis based on SOC monitoring and public threat intelligence review (ESET, Microsoft, Barracuda, FBI advisories).