QR Codes in Phishing Emails

Overview

Cybercriminals are increasingly using QR codes in phishing emails—a tactic known as quishing—to trick recipients into scanning malicious codes that redirect them to fraudulent login pages. This method exploits the familiarity of QR codes in everyday life, making victims more likely to scan without suspicion.

How Quishing Works

• Email lure: Messages impersonate HR, payroll, or IT notices with urgent wording.
• QR code placement: Instead of a clickable link, attackers embed a QR code in the email body or attachment.
• Mobile redirection: Scanning sends victims to a fake sign‑in page designed to steal credentials.
• Detection evasion: QR codes conceal destinations from hover checks and bypass text‑focused security filters.

Rising Trend

• Record levels: ESET telemetry shows quishing peaked in April 2026.
• Global impact: About 100,000 detections monthly; U.S. (19%), Spain (17%), Mexico (6%).
• Beyond inboxes: Fraudulent QR codes placed on parking machines, bicycles, tickets, and toll notices to harvest payment data.

Why QR Codes Work

• Familiarity: Seen on menus, payment terminals, and workplace workflows, making them appear routine.
• Emotional triggers: Themes like pay, benefits, or urgent updates prompt quick responses.
• Mobile blindspots: Personal devices often lack enterprise protections, and users cannot hover to preview destinations.

State‑Aligned Campaigns

• Kimsuky spearphishing: FBI warned in January 2026 about North Korea‑aligned actors using malicious QR codes in targeted attacks.
• ClickFix overlap: Some campaigns combine QR lures with persistent backdoors, expanding attacker footholds.

Defensive Guidance

Organizations and individuals should:

• Slow down: Avoid scanning unexpected codes, especially in urgent emails.
• Inspect destinations: Check the full URL before entering credentials or payment details.
• Verify requests: Confirm HR, IT, or bank messages through trusted channels.
• Deploy layered email protection: Use systems that decode QR codes and scan extracted URLs.
• Extend mobile security: Apply enterprise protections to personal devices.
• Train staff: Teach employees to recognize QR‑based phishing tactics.

Expert in the Cloud Insight

Quishing demonstrates how attackers exploit human trust in familiar technology. By embedding malicious links in QR codes, they bypass traditional defenses and move attacks onto less‑protected mobile devices. The lesson is clear: QR codes must be treated with the same caution as suspicious links, and organizations must adapt their defenses to decode and inspect them proactively.