Quishing: how QR code phishing works and how to stop it in your business

By Kike Gandia · Co-Founder & CEO, OSCP

Quishing is phishing with QR codes: instead of a link, the message carries a QR code that leads to a fake page, almost always a Microsoft 365 or Google Workspace sign-in. It works because the URL travels inside an image that many filters did not analyse, because it is scanned on a phone, outside the company's EDR, proxy and DNS filtering, and because a small screen makes the address harder to check. This guide covers the typical business scenarios, how these attacks usually end, the warning signs, and the technical and training controls that stop them.

What quishing is and why it works

Quishing (from QR and phishing, also called QR code phishing) is a phishing variant where the malicious link does not appear as text but is encoded in a QR code. The victim scans it with their phone and lands on a page that imitates a sign-in, a payment gateway or a download. In a corporate setting the goal is almost always the same: work account credentials.

It works for three reasons that add up:

• The URL is inside an image. Email filters were designed to analyse links, and a QR code is an image with no visible link. For years it was not common practice to decode every image in every message, and these emails usually carry very little text, which leaves the filter even fewer signals.
• Scanning takes the user outside the perimeter. The email arrives on the corporate laptop, protected by EDR, a proxy and DNS filtering, but the QR code is scanned on a phone, often a personal one with none of those layers. The click the company could have blocked happens on a device it cannot see.
• The URL is harder to read on a phone. The small screen, the truncated address bar and the habit of opening whatever the camera suggests mean that signs someone would notice on a computer go unnoticed.

This is not a marginal threat: according to the Microsoft Digital Defense Report 2026, Defender for Office 365 detected more than 145 million QR code phishing attacks between July 2025 and June 2026.

Typical quishing scenarios in a business

The QR code can arrive through almost any channel. These are the scenarios seen most often and the control that cuts each one off:

The first three are after corporate credentials and are the ones an IT manager should worry about most. The physical ones usually target the employee's own card details, but they rely on the same habit: scanning without checking where the code leads.

Email quishing: the "security verification" pattern

The quintessential corporate scenario is an email impersonating Microsoft, the IT department or an e-signature platform, asking the user to scan a QR code "from your phone" to complete a verification. Spain's national cybersecurity institute, INCIBE, documented a campaign of this kind against businesses in August 2023: emails carrying the recipient's name and company, subjects such as "Security Authentication for your account", often sent from already compromised accounts, and a QR code leading to a copy of the Microsoft sign-in page with the victim's address already filled in. INCIBE warned that the method could get past security tools and work even with two-factor authentication enabled.

The usual variants:

• The QR code in the email body, as an image and with as little text as possible so the filter gets no clues.
• The QR code inside a PDF or attached document, which forces the filter to open the file and decode the image inside it.
• A QR code that is not a clean image: drawn with tables or blocks of colour, split across two images that the eye merges and the filter analyses separately, or nested inside another code. These are evasion techniques email security vendors have documented in commercial phishing kits.

The pretext almost always creates urgency and pushes the user to their phone: "your MFA expires today", "you have a document waiting for signature", "update your details before payroll closes". An email that sends you to your phone for something you could do with one click on the computer you are reading it on is, in itself, a warning sign.

Physical QR codes and QR codes in messaging apps

Outside email, quishing exploits places where scanning a QR code is perfectly normal. The best-known case is a sticker with a fake QR code placed over the legitimate one on a parking meter, a restaurant menu, a poster or a flyer. The FBI warned in January 2022 about criminals tampering with QR codes to divert payments and steal credentials, and in Spain both INCIBE and the National Police have warned about fraudulent stickers on parking meters and in public spaces.

For a business this scenario matters for two reasons. First, an employee paying for parking on a client visit with the company card exposes a corporate payment method. Second, physical QR codes are inside the office too: the guest Wi-Fi poster, an internal survey, the cafeteria or an event. Anyone with physical access, a visitor included, can stick one on top.

Messaging apps add another variant: a QR code that does not lead to a website but links your account to the attacker's device. Apps such as WhatsApp or Signal use legitimate QR codes to connect a computer to the phone's account; if someone convinces you to scan a code they generated with your app, they start receiving your conversations without needing any password. Google Threat Intelligence documented campaigns in 2025 that abused Signal's device linking this way. The control is simple and rarely practised: check the list of linked devices from time to time.

How it usually ends: session theft with AiTM kits

The QR code is only the wrapper. What sits behind it is usually an adversary-in-the-middle (AiTM) phishing kit rented as a service. The page is not a static copy of the sign-in: it relays traffic to the real Microsoft or Google portal, so the victim sees their own company logo, enters the password, approves the MFA prompt and everything seems to work. Meanwhile the kit keeps the session cookie, and the attacker reuses it from their own browser without signing in again.

From there the sequence is well known:

• Access to the mailbox and files under the victim's identity.
• Persistence: forwarding or inbox rules, registering their own MFA method or consent to a malicious application.
• Exploitation: invoice fraud and bank account changes, or internal phishing from a legitimate account, which colleagues trust far more than an external email.

That is why MFA based on codes or push notifications is not enough against quishing: the relay captures the code just as it captures the password. How AiTM works in detail, the traces it leaves in the logs and the response in Microsoft 365 are covered in our guide on how attackers hack Microsoft 365.

Warning signs for employees

A QR code cannot be read with the naked eye, so the signs are in the context and in what happens right after scanning it:

• An email asking you to scan a QR code to sign in, verify or "reactivate" something. Neither Microsoft, nor Google, nor your IT department asks for that by email.
• Urgency and consequences: the account locks today, the document expires, payroll will not be paid.
• Insistence on using your phone for something you could do from your computer.
• Little text and a big QR code, or an attachment whose only content is the code.
• A domain that does not fit in the camera preview: lookalike names, long subdomains, URL shorteners or domains unrelated to the supposed sender.
• A sign-in page that already shows your email address after scanning a QR code you were not expecting.
• On paper: a sticker over another code, edges that do not line up, or a QR code where there was none before.
• A payment or sign-in page after scanning a poster's QR code, when you expected a menu, information or an official app download.

Technical controls: email, identity and mobile

No single control solves quishing. What works is breaking the chain at several points:

• An email filter that decodes QR codes. It should extract the URL from images in the body and in attachments and run it through the same reputation checks and detonation as a normal link. The main products already do this, but check that the feature is enabled and that it covers PDFs, not just embedded images.
• Phishing-resistant MFA (FIDO2 or passkeys). This is the control that reduces impact the most: the credential is cryptographically bound to the legitimate domain, so the relay page cannot use it and the AiTM kit has no session to steal. Start with administrators, executives and finance.
• Conditional access requiring a managed or compliant device. Even if the attacker gets the password or the cookie, access from their machine does not meet the policy. It is especially effective when users should only work from corporate devices.
• Protecting MFA method registration. In Microsoft Entra ID you can make the "register security information" action conditional on trusted locations or a strong method, so whoever steals a session cannot add their own authenticator from another country.
• Mobile device management and protection. MDM and mobile threat defence on corporate phones, with web filtering that blocks malicious domains when the QR code is opened. On personal phones this is rarely feasible, which is why identity controls matter more than device ones.
• Messaging under control. Limit external Teams messages to trusted domains and review linked devices in the messaging apps the company uses.
• Detection. Alerts for successful MFA sign-ins from unusual network providers or locations, for new inbox rules and for newly registered MFA methods.

Process and training controls: one rule people can remember

Quishing training works better with one short rule than with a long list:

A QR code that reaches you in an email, a document, a chat or a poster should never lead you to enter your password or "reactivate" anything.

The rule has one nuance worth explaining, because legitimate sign-in QR codes do exist: the one shown when setting up Microsoft Authenticator, the one a computer displays when you sign in with a passkey stored on your phone, or the WhatsApp Web one. The difference is that those are generated by the screen where you yourself started the process; they never arrive inside a message.

The other habits worth training:

• Read the URL before opening it. The phone camera shows the domain before opening the page; the habit is to read it, not to tap out of inertia.
• Take the known route. If the message says there is a pending document or a problem with the account, go in by typing the usual address or through the official app, never through the QR code.
• Pay through the official app for parking or the service, not through the QR code stuck on the machine.
• Report it, from the phone too. The report button in the email client, a clear channel to IT or the SOC, and the assurance that reporting late is better than not reporting. If someone has already entered credentials, every minute counts to revoke the sessions.

Tone matters: an employee who fears a reprimand will not mention having scanned something odd, and that warning is what makes it possible to cut off an AiTM attack before the attacker uses the stolen session.

How to include quishing in a phishing simulation

A simulation campaign that only uses links leaves out one of the most used vectors today. Common simulation platforms, including Attack Simulation Training in Microsoft Defender for Office 365, already support QR code payloads. What to keep in mind when including them:

Some nuances:

• The scan itself cannot be measured: what the platform records is the visit to the URL, which is the equivalent of a click.
• Device type, with care. Collect only what is necessary and include it in the information given to staff beforehand, since this is data about devices that may be personal.
• Vary the pretext and the format: QR code in the body, in an attached PDF, in a Teams message or, if the scope allows it, on a physical poster inside the office.

As with any simulation, the results are for adjusting training and controls, not for singling people out. A quishing campaign with many visits from personal phones is, above all, an argument for prioritising phishing-resistant MFA.

FAQ

What is quishing?

It is phishing that uses a QR code instead of a link. The QR code leads to a fraudulent page, usually a fake Microsoft 365 or Google Workspace sign-in or a payment gateway, to steal credentials or card details. The name combines QR and phishing; it is also called QR code phishing.

Why does the spam filter not catch QR code emails?

Because the link is not in the text but encoded in an image, and for years filters did not decode every image in every message. Current filters already extract URLs from QR codes, but attackers respond with codes inside PDFs, drawn with tables or split across several images. That is why the filter is one layer, not the solution.

Does MFA protect against quishing?

It depends on the type. SMS, code or push-notification MFA does not stop an AiTM kit, because the relay page captures the code and the resulting session. Phishing-resistant MFA, with FIDO2 or passkeys, does neutralise it, because the credential only works on the legitimate domain.

What should I do if I scanned a suspicious QR code?

If you only opened the page and typed nothing, close it and tell IT so they can block the domain and look for other recipients. If you entered your password or approved an MFA prompt, report it immediately: the credential must be changed, sessions revoked, and mail rules and any added MFA methods reviewed. Reporting quickly matters more than having fallen for it.

Is it safe to scan the QR code on a parking meter or a restaurant menu?

Usually yes, but check that it is not a sticker over another code and read the domain the camera shows before opening it. If the code takes you to pay or sign in, use the official app or type the address yourself. Be especially careful if you are paying with a company card.

Can quishing be included in a phishing simulation?

Yes, and it should be. Simulation platforms can send emails with QR codes and measure visits, credentials entered and reports. It requires the same safeguards as any simulation —prior information, a training purpose and data minimisation—, with extra care because scanning usually happens on personal phones.

What is the difference between quishing and QRLjacking?

In quishing the QR code leads to a fake website where the victim hands over their details. In QRLjacking the victim uses their own app to scan a sign-in or device-linking QR code generated by the attacker, such as the WhatsApp Web one, and without typing anything gives the attacker's device access to their account.

Related service

employee security awareness training: hands-on phishing defence

Related content

• Phishing simulations for businesses, QR codes included
• How attackers hack Microsoft 365: AiTM phishing and session theft
• What to do if an employee falls for phishing
• What to measure in a phishing simulation
• Common Entra ID conditional access mistakes
• What social engineering is and its techniques

Sources

• INCIBE — New phishing campaign using QR codes (business advisory, August 2023, in Spanish)
• FBI IC3 — Cybercriminals Tampering with QR Codes to Steal Victim Funds (I-011822-PSA, January 2022)
• Microsoft Digital Defense Report 2026 — QR code phishing attacks detected by Defender for Office 365
• Microsoft Security Blog — How Microsoft Defender for Office 365 innovated to address QR code phishing attacks (November 2024)

Train my team against quishing