Cyberpediaby Brain
ENDEFR

Quishing: QR code phishing

A booby-trapped QR code hides its address inside an image and leads to a fake login page. How to spot it and what to do before scanning.

In 30 seconds

Where it happens
Emails, text messages, fake invoices, posters, menus, product labels, shared PDFs or spreadsheets1.
What the attacker wants
To send you to a fake login page, or to get you to download malicious software1.
The reflex
Before scanning a code, check where it comes from through another channel, for example by calling the sender1.
If it is already done
Do not enter credentials or payment details until the site's authenticity is confirmed1. Report the message, then delete it without replying2.

What it is

Quishing is a phishing attack that uses a QR code. The code is an image: it does not show the address it contains, and the user cannot see it in advance1.

For an employee, the trap is an ordinary gesture. You scan a code received in an email, stuck on a poster or slipped into a shared document, and you land on a page that asks you to sign in or pay1.

Straight answers

What is quishing?

It is phishing through a QR code. Proofpoint describes it as a social engineering attack that redirects victims to malicious sites or triggers malware downloads. Unlike classic phishing, which relies on links written out in plain text, it uses an image code1.

Why is a QR code harder to judge than a link?

Because the address is invisible. Proofpoint notes that the user cannot see the URL contained in the code in advance, which makes the tool exploitable1.

Why do company filters not always catch it?

According to Proofpoint, quishing bypasses email filters1. Tim Bedard of IBM Expert Labs, quoted on the same page, explains that email security tools look for known suspicious links in messages, but do not analyse images to find links hidden in a QR code1. Specialised solutions exist: they extract QR codes from emails and from attachments such as PDFs, decode the address and assess its risk1.

Is my personal phone affected?

Yes. Proofpoint writes that this tactic leaves organisations vulnerable through both work devices and personal devices1. The page does not detail this point further.

What should I do before scanning?

Proofpoint advises confirming a code's legitimacy with the sender through another channel, such as a phone call, before scanning a code received by email, by text message or in a public place1. CISA adds a general rule: if a message could be real, do not click any link or call any number it contains, and find another way to reach the company or the person2.

What if the code looks suspicious?

CISA recommends reporting the message, then deleting it without replying2. The UK NCSC points out that reporting a scam message is free and takes a minute, and that it has the power to investigate fraudulent addresses and sites in order to have them taken down3. In a company, Proofpoint recommends clear channels so that employees can report a suspicious code without fear of reprisals1. The NCSC observes for its part that employees who fear for their jobs do not report their mistakes4.

1Inside the attacker's head1 min

According to Proofpoint, the method follows four steps1.

  • Create the code. Free online tools produce QR codes that point to a phishing site or to a domain hosting malware.
  • Distribute it. The code is placed in a phishing email, on a fake invoice, on a poster, on a restaurant menu, or stuck over a legitimate QR code.
  • Push for speed. Messages call for immediate action, for example "Scan to unlock a discount" or "Verify your account".
  • Exploit the scan. The victim lands on a fake login page, a credential harvester or a malware download.

MITRE ATT&CK lists phishing among the initial access techniques. It describes sender spoofing, which can fool both the recipient and automated security tools, and "thread hijacking": the attacker includes the target in an existing conversation whose messages contain malicious files or links5. The MITRE page consulted does not mention QR codes: these tricks are those of phishing in general.

2What you see on screen1 min

The typical message asks you to scan a code, often with a pressing reason. Proofpoint cites "Scan to avoid account suspension" as an example of an urgency-based lure1. Codes also come as "account verification" alerts or shipping notices, with a bank, a government agency or a supplier as the apparent sender1.

In public places, Proofpoint cites restaurant menus, parking meters, shop posters and event flyers, with promises of discounts, WiFi access or exclusive content1. Inside the company, codes can hide in internal PDFs or spreadsheets posing as surveys or training material1.

Once the page is open, CISA lists the classic signs of phishing: urgent or emotional language, a request for personal or financial information, untrustworthy shortened addresses, and misspelled addresses or links such as "amazan.com"2. Proofpoint cites "arnazon.com"1. CISA specifies that the old sign of spelling mistakes is no longer reliable: in the age of artificial intelligence, some emails have perfect grammar2.

The NCSC warns that no training will let people spot every attempt, and that examining every email in detail would leave too few hours for the actual work4.

3Under the hoodIT teams1 min

A QR code is a machine-readable matrix that can hold up to 7,089 numeric characters or URLs, and can be read with a smartphone camera or a reader app. Its design includes error correction, which lets it work even when partly damaged1.

On the defence side, Proofpoint describes several layers. Analysis engines use computer vision models to find QR codes in emails, decode the addresses and assess their risk. Online sandboxing extracts codes from attachments and simulates a visit to the addresses in an isolated environment before delivery. According to Microsoft, quoted by Proofpoint, this pre-delivery check blocked about 1.5 million quishing attempts a day in 20241.

Against credentials stolen on these fake pages, Proofpoint recommends multifactor authentication, and the DMARC, SPF and DKIM protocols against spoofed emails1. The NCSC explains that DMARC stops phishers from spoofing an organisation's domain, and that several layers of defence are needed rather than relying on users' eyes alone, because some attacks will always get through4.

4Case filesReal cases1 min

2023: fake company invoices

Proofpoint reports a 2023 attack that imitated company invoices. Employees were directed to fake payment portals1. The page names neither the targeted company nor the author of the attack.

2024: restaurant menus covered over

According to Proofpoint, a 2024 campaign targeted restaurant chains by placing malicious QR codes over printed menus. Customers were redirected to credential-harvesting pages that imitated loyalty programmes1. Again, the source gives no chain name.

These two cases come from a single commercial source, which gives no victim figures. The UK NCSC also published a post on 8 February 2024 titled "QR Codes - what's the real risk?", of which the page consulted reproduces only the title and a teaser sentence3.

Fact sheet

Identifier
CP-006
Wing
1. Attacks and techniques
Brain skill
Detecting Phishing (detect_phishing)
Brain reflex
cr-006
Diagram
G1 · Attack vs Defense Chain
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. Proofpoint, “What Is Quishing (QR Phishing)? Definition | Proofpoint US”, 31 March 2025. https://www.proofpoint.com/us/threat-reference/quishing (accessed 3 November 2026)
  2. CISA, “Recognize and Report Phishing | CISA”. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026)
  3. NCSC (United Kingdom), “Phishing scams: how to spot and report them”, 26 November 2021. https://www.ncsc.gov.uk/collection/phishing-scams (accessed 3 November 2026)
  4. NCSC (United Kingdom), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)
  5. MITRE ATT&CK, “Phishing, Technique T1566 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1566/ (accessed 3 November 2026)

Cite this article

Brain, “Quishing: QR code phishing”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/quishing-qr-code-phishing/

BibTeX 
@misc{brain_cp006_en_2026,
  author = {Brain},
  title = {Quishing: QR code phishing},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/quishing-qr-code-phishing/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence