Quishing: Phishing Hidden in QR Codes

What is quishing?

Quishing, from "QR" and "phishing", is an attack where the malicious link is encoded as a QR code rather than an ordinary hyperlink. The victim scans it with a phone and lands on a fake login page. The code itself is not an attack technology: it is an address written in graphical form, the same as the one on a restaurant bill.

The deception looks the same as in other types of phishing. Only the wrapper around the link changes, and that is enough to bypass much of the email tooling companies have spent a decade buying. The filter is not broken. It never receives the input it was built to examine.

The term has reached the glossary of the EU agency ENISA, which defines quishing as QR code-based phishing that directs victims to malicious websites or payloads. Not a conference curiosity, then, but a named category in the European threat landscape.

How much of it there actually is

In the first quarter of 2026, QR code phishing was the fastest-growing email attack variant. Detections rose from 7.6 million in January through 12.9 million in February to 18.7 million in March, up 146% and the highest monthly figure in at least a year. The sample was roughly 8.3 billion email threats from the same period.

The same vector does not climb in a straight line in every dataset. In the fourth quarter of 2025, email attachments carried 655,673 unique malicious QR codes, down 9% from 716,306 the quarter before. The fall did not mean less risk: attackers rebuilt their infrastructure and changed targets, timing part of it to Black Friday week.

The split by industry says more than the headline number. No sector stood out far enough to call it one industry under fire, and that is informative: these campaigns run broadly rather than profiled to a vertical.

Impersonated brands rotate faster than sectors. In the fourth quarter of 2025 Walmart dominated (61%), followed by AstraZeneca (23%), which had not been attacked via QR code even once the previous quarter. DHL, the most-impersonated brand of Q2 2025, accounted for just 0.7% by then. The target list gets rebuilt from scratch.

The proportions matter. Analysing 4,875 incidents between July 2024 and June 2025, ENISA named phishing the dominant intrusion vector at 60% of cases, against 21.3% for vulnerability exploitation. In the United States, phishing and spoofing remained the most reported internet crime, with 191,561 complaints in 2025.

A separate pattern concerns leadership. Abnormal Security calculated that in the fourth quarter of 2023, C-suite members received 42 times more QR code attacks than the average employee, and 89.3% of those attacks went after credentials. That data is two years old, so treat it as a description of the mechanism. Target selection works as we describe under spear phishing and whaling.

Why the email gateway does not stop it

The gateway lets quishing through not out of negligence but because its strongest mechanisms need a URL, and this message has none. Four attacker decisions create that gap.

The code is an image, not text

Domain reputation, blocklists, link rewriting and sandbox detonation all start by extracting an address from the content. A QR code is not an address but a picture of one, so a text analyser walks past it. To see the destination, the gateway must recognise a code inside the image and decode it: an extra step for every attachment, and the first place attackers break the chain. Codes get rotated, made noisy or split into fragments.

It usually travels in an attachment

In March 2026, 70% of malicious QR codes arrived in a PDF attachment and 24% in a DOC or DOCX file. Codes pasted into the message body accounted for 5%, although that variant grew 336% month over month in March. The attachment suits the attacker: the document has to be rendered before the graphic is visible, and it can hide the real address inside PDF annotations.

The destination hides behind a redirect chain

The address in the code rarely leads straight to the credential-harvesting page. It usually points at a generator, which redirects to a shortener (most often TinyURL in Q4 2025), which lands on the login panel. Add CAPTCHA gates an automated crawler will not pass: March 2026 saw 11.9 million such attacks, up 125%. Every link can be repointed without touching the code that was sent.

The message looks like a process you already run

QR code campaigns imitate a document for signature, an HR update, an invoice or a delivery notice, where an attachment is the norm. ENISA documented the Scanception campaign, in which QR codes in PDF attachments sent victims to credential-harvesting pages hosted on trusted cloud platforms, including in the EU. Hosting on a reputable domain means the destination reputation raises no alarm either.

# QR code generator domains — APWG Phishing Activity Trends Report, Q4 2025
scan[.]page             61.1% of Q4 2025 detections
view[.]page             38.6%
qr.scanned[.]page       36.6%
qrfy[.]io               18.3%
jsj[.]top               415,345 detections (down 64% from Q3 2025)

# Dropped out of detections entirely between Q3 and Q4 2025
qrto[.]org   qr[.]pro   me-team[.]org   bio[.]link

# Redirect layer seen most often in Q4 2025
tinyurl[.]com

# Retrospective review of your own mail flow
1. inbound mail whose body is an image and contains no URL at all
2. PDF / DOCX attachments whose rendered pages hold a decodable QR code
3. decoded QR destinations resolving to a shortener or a code generator
4. sign-ins minutes later from a mobile user agent and an unfamiliar ASN

Why another filter will not fix this

The APWG data from the fourth quarter of 2025 shows how quickly this infrastructure moves. JSJ[.]TOP, the most prolific source in Q3 with 1,149,088 detections, produced 415,345 in Q4, down 64%. Four other generators, QRTO[.]ORG, QR[.]PRO, ME-TEAM[.]ORG and BIO[.]LINK, vanished from detections. New ones took their place: SCAN[.]PAGE alone accounted for 61.1%, ahead of VIEW[.]PAGE (38.6%) and QRFY[.]IO (18.3%).

The conclusion is uncomfortable for anyone relying on a domain blocklist. Blocking a generator buys roughly one quarter, then the list starts from zero. There is a further problem: those same generators carry legitimate traffic, because marketing agencies, museums and conference organisers use them. Blocking the domain hits that traffic too, which is why such blocks rarely last.

How the attack works

Where malicious QR codes appear

Quishing does not stop at email, and the physical variant is the hardest: a sticker on a parking meter passes through no gateway and leaves no log. The table sorts the variants by what you can observe before scanning.

The leaflet-under-the-wiper variant is documented on the government side in Poland. In April 2026 the National Revenue Administration warned about fake payment demands slipped under windscreen wipers. They carry the agency logo, look official and hold a QR code supposedly leading to the details of a fine. The agency does not serve demands as leaflets, and the code may lead to a malware download.

Stickers on parking meters were described earliest on the other side of the Atlantic: in December 2023 the US Federal Trade Commission warned that fraudsters cover original codes with their own, so a driver paying "for parking" hands over card details instead. The Polish banking sector picked the thread up in an autumn 2025 campaign, and the 2025 CERT Polska annual report adds campaigns impersonating couriers and the national e-Delivery system.

Why a phone is a poor place to verify anything

The whole point of quishing is to move the decision from a computer to a phone, because a phone strips away the signals fraud detection relies on. This is not carelessness. It is how much a small screen can show at all:

• The address bar is truncated to the start of the domain, so a URL with the brand name in a subdomain looks convincing; it hides on scroll, and a fake page can draw its own
• There is no hover preview, because there is no cursor: you learn the address after the page opens, and a QR code gives you nothing to long-press
• Headers and full sender details sit two taps deeper in a mobile mail app
• The phone is often personal, so it falls outside MDM, DNS filtering and browser policy
• A password manager will not offer credentials on an unfamiliar domain, but typing them by hand is easier on a phone
• The decision happens on the move, not at a desk

The conclusion is inconvenient: if the matter involves logging in or money, verification has to move back to a device where the whole address is visible. The cheapest version of that rule is "do not scan, type". The same mechanism appears under SMS phishing: different channel, identical bottleneck.

How to spot quishing

The rule is simple: a QR code is a link from an unknown sender. The differences between a sound code and a swapped one show up earlier than people assume.

One caveat belongs here, and it rarely gets written down. Checking the address is necessary but does not settle the matter, because some generators allow the destination to be swapped after the code has been printed. A code that led to an ordinary page on Monday can lead to a login panel on Tuesday. Phishing-resistant authentication therefore matters more than vigilance alone.

How to protect your organisation

It helps to split the defence in two, because mixing the lists is the most common reason neither works. The first is for the person standing in front of a QR code with five seconds to decide.

The second is for the organisation, and it carries the weight: the first list only works when the second removes final responsibility for a mistake from the user.

I scanned the code and entered my details, now what

If credentials reached a fake page, the order of steps matters more than speed. This assumes a corporate account; for a personal one the steps are identical, with the provider support desk taking the security team role.

1. Minutes 0-5The person who scanned the code
   Cut the session, not just the password

   Change the password from another, trusted device and immediately sign out of all active sessions. A password change alone does not invalidate a token the attacker may already hold. If the same password works elsewhere, change it there too.

2. Minutes 0-10The person who scanned the code
   Report before you start fixing

   Tell the security team or IT and give them four things: where the code came from, when it was scanned, which device was used and what was entered. Keep the message, the attachment or a photo of the sticker.

3. Minutes 10-30Security team / IT
   Check what happened after the login

   Review sign-in logs for a new location, device and unusual hour. Check mail forwarding rules, newly registered MFA methods, fresh application tokens and file shares. Account takeover shows up in those changes, not in the login itself.

4. Minutes 30-60Security team / IT
   Establish the scope of the campaign

   Search the rest of the organisation mailboxes for the same message and attachment; for a physical variant, check the location and nearby devices. Remove the copies, block the destination domain and warn the team. If card details were involved, notify the bank.

5. Same daySecurity team / process owner
   Report externally and close the gap

   Report the incident to your national CERT, and for a sticker in a public place also to the zone operator or site manager. If personal data may have been exposed, start the regulator notification path. Finally, answer which control has to change so the next code does not look credible.

Frequently asked questions about quishing

Conclusion

Quishing shows how fast attackers route around a control that handles the previous vector well. Filters learned to analyse links, so the link left the message body for an image, and from there for an attachment. Volume can fall 9%, and a few months later detections climb 146%, because only the infrastructure changed.

Another filter buys about one quarter. Two things change it for good: handling login and payment matters on your own path rather than the one you were pointed at, and authentication that cannot be handed to a fake page. Everything else is supporting work.

A QR code is a link you cannot see before you click it. That alone is reason enough to slow down.