QR Code Phishing (Quishing): Why a Simple Square Is Slipping Past Your Defenses

A QR code looks harmless. It is a black and white square that opens a menu, a parking payment page, or a conference schedule. That familiarity is exactly why attackers like it.

QR code phishing, often called quishing, hides a malicious link inside an image. The victim scans it, lands on a fake login page, and hands over credentials. Many email security tools never see the link at all.

This post explains how quishing works, why it succeeds against careful people, and what security teams can do about it. It also covers how awareness training and simulations fit into the response.

What Is QR Code Phishing (Quishing)?

Quishing is a phishing technique that uses QR codes to deliver a malicious URL. The attacker embeds the link in the code instead of placing it in the message body. The victim scans the code with a phone and follows the link without ever seeing the address.

The name combines “QR” and “phishing.” The goal stays the same as in any phishing attack: steal credentials, deliver malware, or trick someone into approving a payment.

What changes is the delivery. A traditional phishing email contains a clickable link that security tools can inspect. A quishing email contains an image. The link only becomes visible after a human points a camera at it.

Why Attackers Are Adopting Quishing

Attackers adapt to whatever defenders block. Email gateways got better at scanning links and attachments, so attackers looked for a gap. QR codes offered one.

Three factors make quishing attractive:

• Filters struggle with images. Many secure email gateways scan text and URLs well. They scan embedded images less reliably, and reading a QR code inside an image takes extra processing.
• The attack moves to a personal device. When an employee scans a code with a phone, the traffic often leaves the corporate network. Web filters, endpoint agents, and proxy rules may not apply.
• People trust QR codes. Since the pandemic, QR codes appear on menus, posters, invoices, and packaging. Scanning one feels routine.

Security teams have also noticed a steady rise in quishing across the industry in recent years. The exact numbers vary by report, so treat any single figure with caution. The direction of the trend is clear.

How a Quishing Attack Works, Step by Step

Most quishing campaigns follow the same basic pattern. Understanding it helps you spot where to interrupt it.

Step 1: The lure. The attacker sends an email, prints a flyer, or places a sticker. The message creates a reason to scan. Common pretexts include multi-factor authentication resets, shared documents, HR notices, and delivery problems.

Step 2: The scan. The victim opens the camera on their phone and scans the code. The phone shows a link preview, but many people tap it without reading the address.

Step 3: The redirect. The link often passes through several redirects. Attackers use this to hide the final destination and dodge URL reputation checks. Some pages show a harmless site to scanners and a phishing page to real visitors.

Step 4: The fake login. The victim lands on a page that copies a familiar brand, such as Microsoft 365, Google Workspace, or a corporate VPN portal. They enter credentials. Some kits also capture the MFA code in real time.

Step 5: The aftermath. The attacker logs in with the stolen credentials. From there they read email, send more phishing from a trusted account, or move toward financial fraud.

A Realistic Scenario: The “MFA Update” Email

Consider a mid-sized logistics company with about 600 employees. The finance team receives an email that appears to come from IT. The subject line reads “Action required: MFA re-enrollment by Friday.”

The body is short. It says the company is upgrading its authentication system. Employees must scan the attached QR code with their phone to re-register. The email includes the company logo and a realistic footer.

A finance analyst named Priya sees the deadline and wants to avoid being locked out. She is careful. She does not click links in emails, and she knows the rule. But this email has no link. It has a code.

She scans it with her personal phone. The page looks exactly like her company’s Microsoft login. She enters her password and approves the MFA prompt that arrives a few seconds later. The kit forwarded her input to the real login page in real time, so the prompt was genuine.

Within an hour, the attacker has access to her mailbox. They find an open invoice thread with a supplier. They send a message asking the supplier to update bank details. The fraud attempt goes out from a real, trusted account.

Notice what failed here. The email gateway saw an image and passed it through. The corporate web filter never saw the traffic because Priya used her personal phone on mobile data. Her training told her not to click links, and nothing told her about codes.

That gap is the whole problem. Employees learned to distrust links. They did not learn to distrust a square.

Why Smart, Careful People Still Fall for It

It is tempting to blame the victim. That does not help, and it misreads the situation. Quishing works on good employees for specific reasons.

You cannot read a QR code. With a link, a trained person can hover, inspect the domain, and spot a mismatch. A QR code gives no such clue. The decision to trust happens before any information is visible.

The phone feels safe. Many people treat their mobile device as more personal and more secure than their work laptop. They also hold it closer, read less on it, and move faster.

Urgency does the rest. Attackers pair the code with a deadline. MFA resets, payroll changes, and package notices all create pressure. Under pressure, people skip checks they would normally make.

Training has a blind spot. Most awareness programs focus on links and attachments. If your training never mentioned QR codes, your employees have no reason to treat them as risky.

Where Quishing Shows Up Beyond Email

Email is the most common vector, but it is not the only one. Security teams should think about the full range.

Physical QR codes. Attackers place stickers over legitimate codes on parking meters, restaurant tables, and charging stations. The victim scans what looks like an official code and lands on a fake payment page.

Printed mail and flyers. A letter that appears to come from a bank or courier can include a code. Printed material carries a sense of legitimacy that email lacks.

Documents and PDFs. Attackers embed codes in shared files, invoices, and even meeting invitations. Some campaigns split the code into pieces or use unusual formatting to confuse scanners.

Messaging apps and social media. A code sent through chat bypasses email controls entirely. It can also arrive with a personal message from a compromised contact.

Office environments. A code printed on a notice board, a “Wi-Fi guest access” sign, or a fake IT poster can target employees who are physically on site.

How to Spot a Quishing Attempt

Employees do not need deep technical knowledge to catch most quishing. A short list of habits covers a lot of ground.

• Question the reason for the code. Why would IT ask you to scan a code to reset MFA? Real IT teams rarely work this way.
• Check the sender. Look at the actual email address, not just the display name. Look for small spelling changes in the domain.
• Read the link preview. After scanning, the phone shows the destination. Read it before tapping. Be suspicious of shortened links and unfamiliar domains.
• Watch for urgency. Deadlines, threats, and “last chance” language are classic pressure tactics.
• Be wary of login pages reached through a scan. If a code leads to a credential prompt, stop. Go to the official site by typing the address instead.
• Inspect physical codes. Check whether a sticker sits on top of another code. Peel gently if you can. When in doubt, use the venue’s official app or website.

None of these habits is complicated. The challenge is making them automatic, which takes repetition.

What Security Teams Can Do About Quishing

No single control stops quishing. A layered approach works better. Here is a practical set of steps.

1. Update your email security configuration. Ask your gateway vendor whether it can detect and decode QR codes in images and PDFs. Test it. Send a harmless QR code in a test email and see whether it is flagged or at least logged. Do not assume the feature is on by default.

2. Extend protection to mobile devices. If employees use phones for work, consider mobile threat defense or a managed mobile browser with URL filtering. This closes part of the gap between the corporate network and the personal device.

3. Strengthen authentication. Phishing-resistant methods such as FIDO2 security keys and passkeys defeat real-time credential relay. This is not always quick to deploy, but it removes the main payoff for attackers. Prioritize high-risk roles first, such as finance, executives, and IT administrators.

4. Set a clear policy on QR codes. Tell employees when the company will and will not use QR codes. For example: “IT will never ask you to scan a code to reset your password.” A simple rule gives people something firm to lean on.

5. Make reporting easy. Add a one-click report button to your email client. Reward people who report suspicious messages, even if they turn out to be harmless. Fast reports shorten the time attackers have inside your environment.

6. Monitor for credential exposure. Stolen credentials often surface on criminal marketplaces and in breach dumps. Watching for them gives you a chance to reset passwords before an attacker uses them.

7. Prepare an incident playbook. Decide in advance what happens when someone reports scanning a suspicious code. Reset the password, revoke active sessions, check mailbox rules, and review recent sign-ins. Speed matters more than perfection.

8. Train with realistic examples. Show employees what a quishing email looks like. Include physical examples such as stickers and flyers. Then test whether the training stuck.

Why Simulation and Practice Matter

Reading about quishing helps. Experiencing a safe version of it helps more.

Most people believe they would never fall for a phishing attack. A realistic simulation challenges that belief without real consequences. When an employee scans a harmless test code and lands on a training page, the lesson sticks far better than a slide deck would deliver.

Simulations also give security teams data. You learn which departments are most exposed, which pretexts work best, and whether reporting rates improve over time. That information guides where to spend your next hour of effort.

Frequency matters too. A single annual session fades quickly. Short, regular exposure builds habits. The goal is not to catch people out. The goal is to make the right response feel normal.

How Cruxroot Helps Teams Address Quishing

Quishing is a human problem as much as a technical one. Cruxroot is built around that idea.

Phishing simulations. Cruxroot lets security teams run realistic phishing campaigns, including QR-based scenarios, across their employee base. Teams can test how people respond to different pretexts and see where the gaps are. Results feed directly into follow-up training.

Dark web monitoring. When credentials leak, speed matters. Cruxroot monitors for exposed company credentials and alerts your team, so you can reset accounts before they become an entry point. It does not prevent every breach, but it shortens the window of risk.

Gamified employee training. Short, interactive modules replace long, forgettable courses. Employees learn to recognize threats such as quishing through scenarios, challenges, and progress tracking. Engagement tends to be higher when training feels like practice instead of punishment.

Together, these tools give security teams a cycle: test, measure, train, and monitor. No platform replaces good security architecture. Cruxroot works alongside your email filters, authentication controls, and policies, and it addresses the layer attackers target most often, which is the person holding the phone.

If you work with a managed service provider, ask them how Cruxroot can fit into your existing security program.

Conclusion

Quishing works because it exploits a gap. Email tools struggle to read images, and employees have not learned to question a QR code. Attackers noticed and moved in.

You can close that gap. Update your email controls, protect mobile devices, move toward phishing-resistant authentication, and give your people clear rules. Then test those habits with realistic simulations.

A QR code is just a link in disguise. Teach your team to treat it that way

Check our latest the blog regarding Vishing in the Age of AI Voice Cloning: How to Spot a Fake CEO Call