QR-code phishing, also known as quishing, is becoming a major email security concern as attackers hide malicious links inside images instead of placing them directly in message text.
Traditional email security tools often inspect URLs in the email body, sender reputation, attachments, and known malicious domains. However, a QR code is an image containing encoded data.
When the harmful URL is embedded inside that image, basic URL-scanning systems may not detect it before the email reaches a user’s inbox.
The attacker’s goal is simple: persuade a recipient to scan the QR code with a smartphone. The victim is then sent to a phishing page that can steal Microsoft 365, banking, VPN, or other corporate credentials.
Since the scanning and browsing activity happens on a personal or mobile device, it may also occur outside the organization’s protected network and security controls.
ESET’s H1 2026 Threat Report shows that QRCode/Phishing detections ranked among the top email threats. QRCode/Phishing accounted for 4.1% of the top 10 email-threat detections during the first half of 2026.
This places it alongside common threats such as HTML/Phishing.Agent, malicious Office documents, JavaScript downloaders, and PDF-based phishing.
QR Phishing Evades Scanners
In a typical campaign, attackers send an email pretending to be from an IT team, HR department, cloud provider, delivery company, bank, or payroll service.
The message may claim that the recipient must scan a QR code to view a secure document, update a password, collect a package, review a voicemail, or approve a request.
Instead of including a clickable phishing link, the email contains a QR code image. This technique can reduce the visibility of the malicious destination to older or poorly configured email gateways.
The scanner may identify the image as harmless unless it can extract, decode, and inspect QR-code content. Attackers also benefit from the shift to mobile devices.
A user scanning the code may not carefully examine the destination URL, while a mobile browser can make fake login pages look convincing. The phishing site may use branding copied from Microsoft, Google, Okta, or internal corporate portals.
ESET’s report also found that scripts were the most common malicious email attachment type in H1 2026, representing 46.2% of detections.
Office documents accounted for 14.4%, PDFs for 11.9%, executables for 11.6%, and archives for 9.7%.
These figures show that email attackers continue to use multiple file formats and delivery techniques, with QR codes adding another method for hiding malicious destinations, assets said.
Organizations should use email-security products that can detect QR codes in images, decode their contents, and check embedded URLs against threat-intelligence and reputation services.
Security teams should also inspect image-only emails, suspicious PDF attachments containing QR codes, and messages that urge users to scan a code immediately.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
