Quishing (QR code phishing)

Quishing is a phishing attack that uses QR codes to deliver malicious URLs instead of embedding links directly in text or HTML. A victim scans a QR code, typically from an email, a physical document, or a posted sign, and is redirected to a credential-harvesting page, a malware download, or a fraudulent login portal. The technique exploits the fact that QR codes are opaque: unlike a hyperlink, a human cannot read a QR code and evaluate its destination before scanning.

Quishing and traditional phishing share the same goal: deceive a user into visiting a malicious destination or surrendering credentials. The mechanism of delivery is where they diverge significantly, and those differences determine which defenses work and which do not.

Email security has matured significantly over the past decade. URL detonation, link rewriting, and domain reputation analysis have made it harder for simple hyperlinks to pass through enterprise gateways undetected. Quishing circumvents most of those controls because the malicious URL is encoded inside an image, not a hyperlink. The email body technically contains no suspicious link to scan.

Mobile devices compound the problem. When a user scans a QR code with their phone, the destination resolves on a device that may have weaker security controls than a corporate laptop, is less likely to run enterprise endpoint detection, and whose browser does not enforce corporate web filtering policies.

The physical vector adds a dimension traditional phishing cannot match. QR code phishing stickers placed over legitimate codes in a parking garage, a hotel lobby, or a conference venue reach targets outside any corporate perimeter. There is no email to filter and no corporate device involved at the point of attack.

1. Deploy email security that decodes QR codes. Next-generation email gateways and security platforms that extract and analyze URLs from QR code images in email attachments and bodies can apply the same URL reputation and detonation logic that applies to traditional links.
2. Train users to treat QR codes as untrusted links. Users should be conditioned to treat any QR code, whether received by email or encountered physically, with the same skepticism as an unexpected hyperlink. Scanning a QR code and visiting the result is a two-step action; the pause between them is the intervention point.
3. Extend mobile device management policies. Enterprise mobile device management (MDM) should enforce web filtering on mobile devices so that a QR code scanned on a corporate phone routes through the same controls as a link clicked on a corporate laptop.
4. Verify physical QR codes before scanning. In physical environments, look for signs that a QR code sticker has been placed over a legitimate code: raised edges, misalignment, or different print quality. When in doubt, navigate to the destination manually.

Where does the word quishing come from?

Quishing is a portmanteau of QR code and phishing, following the same naming convention as smishing (SMS phishing) and vishing (voice phishing). The term emerged as QR code-based attacks increased in frequency following the widespread adoption of QR codes during the COVID-19 pandemic.

Can a QR code itself contain malware?

A QR code itself is a data encoding format and cannot execute code. The threat in quishing is the URL the QR code encodes. That URL can direct the scanner to a credential-harvesting page, a drive-by download, or a site that exploits mobile browser vulnerabilities. The QR code is the delivery mechanism, not the payload.

Is quishing more dangerous than traditional phishing?

Quishing is more dangerous in specific contexts because it bypasses email URL scanning, is invisible to the human eye before scanning, and shifts execution to mobile devices that may have weaker enterprise security controls. It is not universally more sophisticated, but it exploits a genuine gap in how most email security is configured.

How do I report a suspected quishing attempt?

Report suspected quishing to your organization's security team the same way you would report a suspicious email. If a physical QR code is involved, photograph it without scanning and report its location. Do not scan a code you suspect is malicious simply to gather more information.