QR Code Phishing: Why 'Quishing' Is Surging in 2026

Why QR codes are the new phishing vector

Email security solutions have become highly effective at detecting malicious URLs in email body text and HTML. QR codes present a challenge because the URL is encoded as an image, making it invisible to traditional text-based URL scanning. When users scan a QR code with their phone, they're taken out of the corporate security environment (managed laptop with security tools) and onto a personal device with fewer protections.

This combination, bypassing email filters and redirecting to less-secured devices, makes QR code phishing remarkably effective.

Common quishing scenarios we encounter

Fake MFA reset notifications containing a QR code to 're-verify your identity'. Document sharing notifications from 'Microsoft' or 'HR' with a QR code to access the document. Corporate policy acknowledgment forms requiring QR code scanning. IT department notifications about required software updates. Parking or building access QR codes left in physical locations. Salary or benefits-related notifications with QR codes for 'secure access'.

Defense strategies

Deploy email security solutions that include image analysis and QR code detection. Implement mobile device management (MDM) that can enforce security policies on personal devices used for work. Add QR code phishing scenarios to your security awareness training. Establish clear organizational policies about QR code usage in official communications. Consider browser isolation for links opened from mobile devices. Report and track QR code phishing attempts to understand attack patterns targeting your organization.