Quishing: How QR Code Phishing Bypasses Corporate Defences

Picture this scenario: your organisation has deployed best-of-breed secure email gateways, a modern EDR solution across every workstation, and robust multi-factor authentication. Yet, on a Monday morning, a financial controller's credentials are compromised without a single automated detection triggering an alert. The attack vector was neither an executable attachment nor a suspicious link tucked into the message body. It was an unassuming black-and-white square embedded within a routine PDF, requesting a security certificate refresh.

Quishing, a portmanteau of QR code and phishing, presents an acute operational headache for modern security leaders. By luring an employee into scanning a graphical matrix with their personal smartphone, the adversary neatens a clean break through the defensive perimeter erected by corporate IT, moving directly out of sight of your monitoring stack.

What Is Quishing and Why Does It Blindside Email Gateways?#

In brief: Quishing conceals a malicious URL within an image-based QR code. Conventional secure email gateways primarily parse raw text, allowing graphical codes to reach user inboxes without tripping automated antispam or URL analysis.

In a standard spear-phishing incident, the Secure Email Gateway (SEG) inspects hyperlinked text, compares targets against threat intelligence feeds, and evaluates attachments within a sandbox. Quishing sidesteps these primary defensive controls. The destination URL does not exist as a plain-text string in the email payload: it is encoded visually as a two-dimensional matrix of pixels, typically saved as a PNG image or wrapped inside a PDF document.

To catch these vectors before delivery, inspection systems must run optical character recognition (OCR) or scan every graphic asset on the fly to decode the matrix. This analysis demands significant computational overhead and introduces latency that few enterprise mail architectures can comfortably sustain at scale.

Adversaries also fine-tune evasion techniques: adjusting colour contrast, embedding corporate logos into the centre of the QR pattern, or using conditional redirects that resolve to a credential-harvesting page only when queried from a mobile browser user-agent. The gateway, finding no explicit payload, delivers the message with a clean bill of health.

The Cross-Device Trap: Pivoting from Corporate Laptop to Personal Mobile#

In brief: By compelling staff to scan codes using a mobile camera, an attacker bypasses workstation EDR and leverages an unmanaged personal environment lacking corporate DNS filtering and proxy oversight.

The critical leverage point in quishing is the cross-device pivot. The employee reads the email on a managed workstation governed by hardened configuration profiles and continuous telemetry, yet the message asks them to grab their mobile to proceed: perhaps to sync an authenticator application, update an HR profile, or resolve an urgent payroll discrepancy.

The moment the team member points their personal smartphone camera (BYOD) at the computer monitor:

• Workstation EDR protection vanishes: the unmanaged smartphone carries no corporate telemetry agent or enterprise endpoint detection.
• Network visibility is severed: traffic routes across public cellular networks (4G/5G), completely bypassing enterprise proxies, next-generation firewalls, and protective DNS filtering.
• Mobile interfaces obscure deception: mobile browser address bars abbreviate URLs for layout convenience, making typosquatting domains and spoofed subdomains extraordinarily difficult to spot with the naked eye.

Crucially, this vector is not confined to email. Attackers frequently extend quishing into physical spaces: placing rogue stickers across workplace EV charging hubs, distributing fraudulent letters masquerading as pension notices, or pinning posters in office kitchenettes prompting staff to join an internal survey.

How Can Security Leaders Defend Against QR Code Phishing?#

When technical controls cannot reliably intercept an image-based threat, long-term resilience relies on critical thinking and clear operational protocol. You cannot physically confiscate every smartphone, but you can dismantle the unthinking reflex to scan whatever appears on a screen.

To build an effective counter-quishing posture, CISOs and security teams should implement several practical measures:

• Establish a clear internal communication baseline: state explicitly within security policies that internal teams (IT, HR, security operations) will never require an employee to scan a QR code to change a password or reset multi-factor authentication tokens.
• Enforce mobile controls where possible: for corporate-issued devices, ensure Mobile Device Management (MDM) solutions include native link-checking capabilities when URLs are opened via the camera app.
• Train through hands-on practice: theoretical policy reading does little to deter well-crafted social engineering. To build lasting instincts, teams must encounter realistic simulated threats. With Super Phisher, you can integrate modern quishing scenarios into your ongoing training programmes, enabling employees to spot telltale discrepancies before they draw their phones.
• Provide a frictionless reporting mechanism: ensure users can flag suspicious physical posters, printed circulars, or graphical emails with one click, without hesitation or administrative friction.

Modern security is not about prohibiting convenient technology, it is about giving your people the contextual awareness to avoid becoming the inadvertent doorway to an enterprise compromise.

Would you like to evaluate your workforce's resilience against modern social engineering techniques? Book a demo with our team to design an engaging training strategy tailored to your operational risks.

BRAIN SECURITY PRODUCT IN ACTION · Super Phisher

Further reading: related articles and Brain Security solutions#

Related articles on this topic

• CEO Fraud 2.0: How Voice Cloning and Deepfake Video Trap Finance Teams (Phishing & Social Engineering) : Protect your finance department from deepfake vishing and CEO fraud. Discover essential out of band protocols and hands-on workforce training.
• MFA Fatigue and Push Bombing: Bypassing Multi-Factor Authentication Without Exploits (Phishing & Social Engineering) : Understand how MFA fatigue and push bombing attacks bypass security controls and train your staff to spot suspicious authentication requests.
• Vishing: How Cybercriminals Manipulate Your Teams and IT Helpdesk (Phishing & Social Engineering) : Explore vishing tactics targeting IT helpdesks, MFA manipulation, and practical defence strategies to protect your workforce against voice fraud.
• PCI DSS v4.0 Requirement 12.6: Strengthening Phishing Awareness (Compliance (NIS 2, DORA, ISO)) : Discover PCI DSS v4.0 Requirement 12.6 mandates for security awareness, anti-phishing, and social engineering training with practical guidance.

Explore Brain Security solutions on our website

• Featured solution : Super Phisher : The phishing simulator that trains your teams on real attacks, from the fake email to the booby-trapped QR code, in a controlled setting that never captures a password.
• Browse use cases by security goal and sector
• Compare our cybersecurity and AI awareness formats
• Explore the full interactive Brain Security catalogue
• Discuss your needs with our team (demo and setup)