QR code phishing (quishing): The attack that arrived with the return to offices and menus

For a few years, the QR code seemed like a technology of the early 2010s, more a curiosity than a daily tool. Then the pandemic arrived, and restaurants replaced menus with QR codes, check-in desks replaced paper with scans, and every event asked you to scan your way in. By 2023, QR codes were everywhere again, and attackers had noticed. A new phishing technique, quickly dubbed quishing, used QR codes to route victims to malicious sites while slipping past the filters and instincts that had long protected against email-based attacks. Here is how quishing works and why training had to adapt.

Why a QR code is a powerful lure

Quishing works because the QR code is an abstraction layer. When an employee sees a suspicious link, years of training kick in: they check the domain, look for typos, hover to preview the destination. A QR code hides all of that. There is no URL to read, no sender address to scrutinize, no text to smell wrong. The employee simply points their phone at a pattern of squares and trusts whatever opens. That single step, scanning and tapping, bypasses most of the verification habits that awareness training had spent a decade building. The attacker turns a familiar, low-stakes action into the point of compromise.

How quishing bypasses traditional defenses

Quishing also exploits a gap in technical defenses. Many email filters are built to detect malicious links in the body of a message, but a QR code is just an image, and the destination URL is not visible to the filter as text. An attacker can embed a QR code in an email that looks entirely benign, with no link for the filter to flag, and route the victim to a credential-harvesting site once they scan. The message might impersonate a payroll portal, a package delivery notice, or a two-factor authentication setup. The email gets through, the code gets scanned, and the compromise happens on the phone, outside the corporate perimeter entirely.

The attack surfaces that made it spread

Quishing spread in 2023 across several familiar surfaces. Attackers embedded QR codes in phishing emails, in printed flyers left in public places, in decals stuck over legitimate QR codes on menus and parking meters, and even in direct messages on collaboration platforms. The common thread was that the code promised something useful, a login, a payment, a verification, and required the victim to act quickly. Because scanning a QR code had become a reflex in daily life, employees did not pause to consider that a code could be a weapon. That reflex was exactly what attackers exploited.

What training had to add

The rise of quishing meant awareness training could no longer assume the threat lived in a visible link. Employees needed a new set of habits. First, treat a QR code with the same caution as a link: if it arrives unexpectedly, especially in an email asking for credentials or payment, do not scan it. Second, verify the destination after scanning, because the phone will show the URL before opening it, and a domain that does not match the supposed sender is a red flag. Third, when in doubt, navigate to the service directly through a known app or website rather than trusting a code that appeared in a message. The goal was to make scanning a considered action, not a reflex.

Why this is a mobile security problem too

Quishing also exposed a long-standing blind spot: mobile devices were often outside the security controls that protected desktops. When an employee scanned a malicious code and landed on a phishing page on their phone, the corporate email filter, the web proxy, and the endpoint detection tool were all out of the loop. The compromise happened on a personal device, over a personal network, and the organization might never see it. This made training more important, not less, because it was often the only control that reached the moment of the scan. Organizations that had ignored mobile security began to recognize the gap.

The durable lesson

Quishing was not a fundamentally new attack, it was an old one in new clothing. Phishing has always relied on getting the victim to act without thinking, and the QR code simply gave attackers a fresh way to trigger that action while evading the defenses built for the last generation of the threat. The lesson for training was the same one that repeats every time the threat landscape shifts: awareness has to evolve as fast as the attacker's tactics. A workforce taught to distrust a visible link, but not a hidden one, was half-prepared. The organizations that updated their training to cover quishing were the ones that closed the gap before it cost them.