Quishing: Phishing That Hides Inside a QR Code

Quishing (QR-code phishing) hides a malicious URL inside a QR-code image instead of clickable text. This evades many email link scanners, which historically parsed hyperlinks but not the contents of embedded images, and it pushes the victim to scan the code with a personal mobile device — typically outside corporate web filtering, EDR and conditional-access controls. The landing page is usually a credential-harvesting or AiTM page. Quishing rose sharply across 2023 and 2024 as attackers sought to sidestep improving link defences.

How It Works

The lure — an email, PDF attachment, letter or poster — presents a QR code with a pretext such as a document to review, an MFA re-enrolment, a payroll change or a parcel notice. The QR encodes a URL to an attacker-controlled site. Because the payload is an image, text-based URL reputation and rewriting often miss it, and the pivot to a phone means the subsequent browsing happens off the managed endpoint. T1566.002 T1566.001

Why It Works

• Image-embedded links bypass scanners tuned for text hyperlinks (newer gateways now decode QR images, so this edge is narrowing).
• Mobile browsers show truncated URLs and personal devices usually lack enterprise web filtering and EDR.
• QR codes carry an air of legitimacy from widespread real-world use (menus, payments, tickets), lowering suspicion.

Detection & Mitigation

• Use mail security that decodes QR images and evaluates the embedded URL; quarantine or flag messages whose only call to action is a QR code from an external sender.
• Extend protection to mobile: enrol devices in MDM with mobile threat defence and route traffic through filtering where possible; deploy phishing-resistant MFA so a harvested credential is not enough.
• Train users that a QR code is a link — preview the destination, never scan codes in unsolicited messages or on unexpected physical notices, and report them.