Quishing: How QR Code Phishing Bypasses Your Email Filters
Your company’s email gateway can parse URLs, detonate attachments in a sandbox, and flag sender domains that were registered yesterday. It cannot read a QR code.
That is the entire premise of quishing. Attackers embed a malicious URL inside a QR code image, drop it into an email, and let the recipient’s phone do the rest. The email contains no clickable link. No suspicious attachment. Just a square of black and white pixels that your security tools treat as a harmless image file.
The attack is not new, but it scaled fast. Abnormal Security’s 2024 threat report found that QR code phishing attacks increased by over 400% in the second half of 2023 compared to the same period in 2022. HP Wolf Security documented corporate quishing campaigns impersonating Microsoft 365, DocuSign, and internal HR portals throughout 2024.
What makes quishing different from garden-variety email phishing is the device switch. The victim reads the email on their laptop but scans the code with their phone. That phone usually sits outside the corporate security perimeter. No web proxy, no DNS filtering, no endpoint detection. The attacker just moved the entire attack to an unmanaged device.