Quishing.

Phishing that hides a malicious URL inside a QR code, prompting victims to scan it with a phone and visit a credential-harvesting or malware page outside corporate defenses. It belongs to the Attacks & Threats category of cybersecurity.

Phishing that hides a malicious URL inside a QR code, prompting victims to scan it with a phone and visit a credential-harvesting or malware page outside corporate defenses.

Quishing (QR-code phishing) is a social-engineering attack in which a malicious link is encoded as a QR code rather than written as visible text. Because the URL is embedded in an image, it often slips past email link scanners and secure email gateways, and scanning typically shifts the victim onto a personal mobile device with weaker controls. Common lures include fake multi-factor-authentication setup notices, parcel-delivery or parking-payment requests, and stickers placed over legitimate codes on posters or restaurant tables. Defenses include image- and QR-aware email filtering, blocking attacker domains, phishing-resistant FIDO2 authentication, mobile threat defense, and user awareness about scanning unsolicited codes.

Defences for Quishing typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: QR-code phishing, QR phishing.