Quishing: A New Threat On The Rise

Quishing did not stay a curiosity for long. Microsoft's Q1 2026 email threat report, built from analysis of 8.3 billion email-based threats, recorded a 146% jump in QR code phishing attempts in a single quarter, with 18.7 million attempts detected in March 2026 alone, up from 7.6 million in January. That is not a slow creep. That is attackers pivoting hard toward a channel that still slips past a lot of email security stacks.

If you have not updated your phishing defenses to account for QR codes specifically, this is the year that gap gets expensive. Here is what changed, what the current numbers actually say, and what holds up as a practical defense.

A quick refresher: what is a QR code, and what is quishing

Kaspersky defines a QR code as a two-dimensional barcode that can hold up to roughly 4,000 characters, far more than a standard linear barcode, including URLs, phone numbers, and payment data. The technology itself is neutral. It gets used constantly for legitimate things: restaurant menus, event check-ins, payment confirmations, Wi-Fi access.

Quishing is the malicious use of that same format: embedding a link to a fraudulent website inside a QR code, then relying on the fact that scanning looks and feels routine enough that people do not pause to verify the destination before their phone opens it. The code itself often looks completely unremarkable. There is no visible red flag the way there might be with a misspelled sender address in a traditional phishing email.

Why this particular attack vector works so well

The core mechanical advantage for attackers is that a QR code hides its destination until after the scan happens, and that scan typically happens on a personal smartphone rather than the laptop where your corporate email security and endpoint protection actually run. A 2026 State of QR Codes report from Uniqode found that 14% of consumers have already fallen victim to a QR code scam of some kind, which tells you this is not a hypothetical risk confined to security conference talks.

The jump between security tools also matters more than people initially assume. Your organization's email security gateway, spam filters, and antimalware software are overwhelmingly tuned for desktop and laptop threats: malicious links, attachments, spoofed senders. A QR code embedded as an image in an email frequently sails past those controls because there is no URL to inspect in the message body itself, just a picture. The URL only appears once a phone camera decodes it, at which point the employee has already left your monitored environment. Microsoft's own researchers put it directly in their Q1 2026 report: "By embedding malicious URLs within image-based QR codes in the body of an email or within the contents of an attachment, threat actors attempt to exploit the limitations of text-based scanning engines and redirect victims to phishing sites on unmanaged mobile devices," as reported by Cybersecurity Dive. Microsoft called QR-code phishing the fastest-growing attack vector of the quarter.

KnowBe4's 2026 phishing research found a related trend worth noting alongside this: a 31.4% increase in phishing attempts that successfully evade secure email gateways, with 64% of these attacks now relying on obfuscation techniques like white-on-white text, HTML smuggling, and hidden instructions buried in page source. QR-based attacks fit squarely into this broader pattern of attackers looking for anything that a traditional filter was not built to parse.

Quishing versus traditional phishing

Cisco defines phishing broadly as counterfeit communication designed to appear legitimate, tricking a target into an action like downloading malware or handing over credentials. Quishing is a subset of that broader category, but it differs in a few concrete ways:

• Quishing requires a physical scan action using a smartphone camera; standard phishing usually relies on a direct click.
• Quishing can happen entirely offline, on posters, table tents, parking meters, or product packaging, not just in email or text.
• Quishing hides the destination URL until decoded; a traditional phishing link at least exposes a suspicious domain to anyone who hovers over it first.
• Quishing skews toward smartphone and tablet targets, since that is where scanning happens, even though the QR code itself might be delivered by email.

For broader context on the threat categories your organization should be tracking in parallel, our guide to top cybersecurity threats and breakdown of email attack types cover adjacent risks worth budgeting defenses around.

How a quishing attack typically unfolds

Most campaigns follow a similar structure, refined over the last few years as attackers have learned what converts:

1. A QR code is generated using a legitimate, freely available tool, since creating a malicious code requires no special skill or access.
2. The code is wrapped in a plausible pretext: update your login credentials, claim a refund, review a voicemail transcript, or redeem an offer.
3. A malicious link, often disguised further with a URL shortener, is embedded in the code and points to a fraudulent site designed to harvest credentials or payment details.
4. The code is distributed through email, printed materials, social posts, or physical tampering over an existing legitimate code.
5. Once scanned, the target lands on a convincing fake page, hands over credentials, and the attacker either uses those credentials directly or pivots to compromise additional accounts.

Urgency remains the dominant psychological lever. Campaigns commonly threaten account lockout within 24 to 48 hours unless the target scans and re-authenticates immediately, a tactic borrowed directly from older email phishing playbooks and simply repackaged for a QR delivery method.

Real, documented examples

Abnormal Security, 2021 to present

Abnormal Security intercepted and blocked over 200 fraudulent emails containing QR codes that impersonated Microsoft 365 voicemail transcription notices, prompting recipients to scan a code and log in to view the transcript. The attackers used compromised but legitimate Outlook accounts to bypass reputation-based email filtering, then hosted the actual phishing pages on Amazon and Google infrastructure to avoid domain-based blocklists.

HP Wolf Security, Chinese-language campaign

HP Wolf Security documented a campaign using fake government labor subsidy notices, complete with official-looking logos, that directed victims to scan a QR code through WeChat and complete a fraudulent "authentication" form to claim a nonexistent grant.

Darktrace interception, 2023

Darktrace intercepted a quishing attempt targeting five senior employees at a technology client, impersonating the internal IT help desk and requesting credential re-entry via QR code, framed around setting up two-factor authentication to add legitimacy. The domains used had been recently acquired, indicating deliberate reconnaissance ahead of the campaign.

FBI advisory on North Korean state-sponsored quishing, January 2026

This is the example that should change how seriously your organization treats this threat. The FBI issued a flash alert in January 2026 warning that Kimsuky, a North Korean state-sponsored group also tracked as APT43, had been embedding malicious QR codes in spear-phishing campaigns against US think tanks, academic institutions, and government entities. "As of 2025, Kimsuky actors have targeted think tanks, academic institutions, and both U.S. and foreign government entities with embedded malicious Quick Response (QR) codes in spear-phishing campaigns," the FBI said in the advisory. "This type of spear-phishing attack is referred to as quishing." Documented lures included a fake questionnaire request from a spoofed foreign advisor, a fake secure-drive invitation from a spoofed embassy employee, and a fake conference registration page designed to harvest Google credentials. This is not commodity cybercrime anymore. It is a technique serious enough for a nation-state intelligence operation to adopt as standard tradecraft.

A 2024 retail sticker-tampering incident

During the 2024 holiday season, attackers physically placed fraudulent QR code stickers over legitimate codes at approximately 200 locations of a major retail chain. Within 48 hours, legitimate scan volume dropped 15% and support ticket volume surged as customers reported issues. The retailer ultimately spent an estimated $2.3 million on remediation and damage control, not counting lost holiday sales, according to incident analysis published by Uniqode. This case is a useful reminder that quishing risk is not confined to inboxes; it extends to any physical space where your brand has printed a code.

Warning signs worth training on

None of these are foolproof, but together they catch a meaningful share of attempts:

• A destination page with spelling errors, low-quality images, or an unusually generic design for the brand it claims to represent.
• A URL beginning with HTTP rather than HTTPS once the code resolves.
• Shortened or otherwise unreadable URLs that obscure the real destination domain.
• Any code that, once scanned, asks for credentials, a password reset, or an app download rather than simply displaying information.
• Codes attached to voicemail transcripts, fax notifications, or receipts, categories that rarely require this kind of interaction in practice.

What actually reduces the risk

Employee training remains foundational, because most organizational security stacks are still tuned for desktop threats, not smartphone-based scanning. But training alone is not sufficient, and it is worth being honest about that limitation rather than overselling awareness programs as a complete fix.

1. Preview-before-open scanning habits

Standardize on QR scanner apps that display the destination URL and require explicit confirmation before opening it, rather than auto-redirecting. This single behavioral change closes off a large share of opportunistic attempts.

2. Destination screening at the organizational level

For organizations that generate their own QR codes for marketing, events, or customer communication, screening destinations against services like Google Web Risk or VirusTotal before publishing, and periodically afterward, catches compromised codes before customers encounter them. Branded, HTTPS-enabled custom domains are also a meaningful legitimacy signal; Uniqode's research found 42% of consumers expect a recognizable domain before they will scan a code from a business with confidence.

3. Governance over who can create or edit codes

Dynamic QR codes, ones whose destination can be changed after printing, are convenient but risky if account access is not tightly controlled. Role-based access, audit logging of every edit, and single sign-on integration close off the scenario where a compromised internal account silently redirects a previously legitimate code.

4. Technical filtering on the email side

Content filtering that specifically flags QR-shaped images in inbound email, combined with optical character recognition to extract and check the encoded URL against existing filtering rules, closes a meaningful part of the gap left by traditional link-based scanning. Sandboxing suspicious codes in an isolated environment before allowing them to reach an inbox adds another layer.

5. MFA that cannot be phished through a QR prompt

Standard multifactor authentication helps, but be cautious about QR-based authentication flows specifically, since they can be spoofed using the exact same mechanics as a malicious code. Phishing-resistant MFA methods are worth prioritizing over QR-driven login flows where possible.

The honest limitation here

No combination of the above eliminates quishing risk entirely, and any vendor or guide claiming otherwise is overselling. The fundamental vulnerability, that a QR code hides its destination until scanned, and that scanning usually happens on a device outside your organization's monitored perimeter, is structural to the technology itself. What these defenses do is raise the cost and reduce the success rate for attackers, not eliminate the category of attack. Given that Microsoft alone tracked an almost 2.5x quarter-over-quarter increase heading into Q2 2026, this is a risk worth budgeting ongoing attention toward, not a box to check once and move on from.

If your organization has significant BYOD exposure, it is also worth revisiting how quishing interacts with shadow IT more broadly, since unmanaged personal devices scanning unverified codes is exactly the kind of blind spot shadow IT policies exist to address. Our list of shadow IT prevention tools covers options that extend some visibility into this gap.