Detecting QR-Code Phishing (Quishing)

QR phishing hides the destination URL inside an image, in the email body or a PDF attachment, so text-based URL scanners see nothing. The victim scans with a personal phone, outside endpoint and proxy controls. Detection therefore centres on decoding the image at the gateway, hunting message shape and watching identity telemetry for the sign-in that follows.

Signals at a Glance

Gateway and Message Hunting

If your gateway decodes QR codes, treat the extracted URL as a first-class field. Hunt for it joined to message attributes that suggest a lure. In Defender for Office the URL table records where a link was found, including QR codes:

// Defender XDR (KQL) - URLs recovered from QR codes in delivered mail
EmailUrlInfo
| where Timestamp > ago(7d)
| where UrlLocation in ("QRCode","Attachment")      // validate the exact UrlLocation values in your tenant
| join kind=inner (
    EmailEvents
    | where Timestamp > ago(7d)
    | where DeliveryAction == "Delivered" and EmailDirection == "Inbound"
    | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject, SenderIPv4
) on NetworkMessageId
| summarize recipients=dcount(RecipientEmailAddress), subjects=make_set(Subject, 3)
          by UrlDomain, SenderFromAddress
| where recipients >= 3
| order by recipients desc
// tune/validate: marketing mail uses QR codes legitimately; enrich UrlDomain with age and reputation

Add a rule for messages with no readable text, which is the shape of an image lure designed to defeat content filters:

// Defender XDR (KQL) - inbound messages with image attachments, tiny body and a themed subject
EmailAttachmentInfo
| where Timestamp > ago(7d)
| where FileType in ("png","jpg","jpeg","gif","pdf")
| join kind=inner (
    EmailEvents
    | where Timestamp > ago(7d) and EmailDirection == "Inbound"
    | where Subject matches regex @"(?i)(mfa|authenticat|password|expire|verify|shared|invoice|benefit|payroll)"
    | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject
) on NetworkMessageId
| summarize attachments=count(), recipients=dcount(RecipientEmailAddress)
          by SenderFromAddress, Subject
| where recipients >= 2
// tune/validate: add a first-contact sender filter if you maintain that watchlist

The Follow-On Sign-In

• Correlate delivery with Entra ID sign-in logs for the same recipient: a new device or location, an unmanaged mobile browser or a failed then successful MFA sequence within minutes of delivery.
• Watch for adversary-in-the-middle tooling behind the landing page: a token issued to one IP and used from another soon after.
• Add a safe-to-scan advisory in awareness training and give users a one-tap report path on mobile.
• Where mobile management is in place, enforce conditional access that requires a compliant device for corporate resources.