Quishing (QR Code Phishing).

A phishing technique that uses a QR code instead of a clickable link to send victims to a credential-harvesting or malware page. It belongs to the Attacks & Threats category of cybersecurity.

A phishing technique that uses a QR code instead of a clickable link to send victims to a credential-harvesting or malware page.

Quishing — short for QR phishing — places a malicious QR code in an email, PDF, poster, parking sign, or restaurant flyer. When the victim scans it with a phone camera, the device opens an attacker-controlled URL outside the controls of corporate email gateways and endpoint browsers. Because QR codes are images, traditional URL filters and DMARC checks frequently miss them, and personal phones are often unmanaged. Quishing surged in 2023 as attackers used it to bypass safe-link rewriting in Microsoft 365 phishing campaigns and to attach fake "MFA enrolment" PDFs. Defences include QR-aware email filtering, mobile MDM with web protection, user training, and verifying every QR URL before entering credentials.

Defences for Quishing (QR Code Phishing) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: QR phishing, QRishing.