QR Code Phishing (Quishing)

Timeline: The Cat and Mouse

2020 ← Attack emerges → 2022 ← Explodes → 2023 ← Defenses emerge → Present

The Evolution

Key Events with Sources

Overview

QR code phishing (“quishing”) embeds malicious URLs in QR codes within emails. Traditional email security scans text URLs but historically ignored images. Victims scan the QR code with personal phones, bypassing corporate security controls entirely and landing on phishing sites.

The Attack

Why QR Codes?

URL Obfuscation:

Traditional phishing: Click here → URL visible, can be scanned
QR phishing: [QR IMAGE] → URL hidden in image, harder to scan

Bypass Security:

• Email security scans text, not images
• URL reputation checks miss embedded URLs
• Safe Links/URL rewriting doesn’t apply

Phone as Vulnerability:

• Personal phones lack corporate security
• No web filtering
• Users trust phone scanning behavior

Common Lures

Microsoft MFA Reset:

Subject: Action Required: MFA Authentication Expiring

Your multi-factor authentication is expiring.
Scan the QR code below to re-authenticate.

[QR CODE → attacker's credential harvesting page]

DocuSign:

Subject: Document Ready for Signature

You have a document awaiting signature.
Scan to view and sign securely.

[QR CODE → fake DocuSign login]

HR/Benefits:

Subject: Open Enrollment - Action Required

Scan to update your benefits selections.
Deadline: [DATE]

[QR CODE → credential harvester]

Parking/Building Access:

Subject: Updated Parking Pass System

Scan to register your vehicle in the new system.

[QR CODE → phishing page]

Attack Flow

1. Victim receives email with QR code
2. Email security scans: no URLs, no attachments → passes
3. Victim scans QR code with personal phone
4. Phone opens browser → phishing page
5. Page mimics Microsoft 365 / corporate login
6. Victim enters credentials
7. Attacker captures credentials
8. Often: Real-time relay for MFA bypass

Technical Details

QR codes can encode:

• URLs (most common)
• Phone numbers (vishing setup)
• SMS messages (smishing)
• WiFi credentials
• Contact cards

Attackers typically use:

• URL shorteners (hide final destination)
• Redirectors (avoid reputation hits)
• Fresh domains (no negative reputation)

Defenses

Email Security Evolution

Modern SEGs now:

1. Extract images from emails
2. Detect QR codes in images
3. Decode embedded URLs
4. Check URL reputation
5. Apply same scanning as text URLs

Limitation: Attackers adapt with:

• QR codes in attached PDFs
• Partial QR codes (multiple images)
• QR codes with visual noise

Mobile Device Management

MDM can provide:

• URL filtering on managed devices
• Warning banners for suspicious sites
• Certificate inspection

Limitation: Personal phones often unmanaged.

User Training

Train users to:

• Be suspicious of unexpected QR codes in email
• Verify sender before scanning
• Check URL after scanning, before entering credentials
• Report QR code phishing attempts

Technical Controls

Block at the source:

Email contains: embedded image with QR code
AND sender: external
AND context: authentication/verification
→ Quarantine for review

Attacker Adaptation

Evasion Techniques

QR Code in PDF:

• Attach PDF with QR code
• Harder to scan automatically
• User opens PDF, scans from there

Multi-Part QR:

• Split QR code across images
• Assembly required to decode
• Evades simple QR detection

QR with Noise:

• Add visual elements around code
• Makes automated detection harder
• Still scannable by phones

ASCII Art QR:

• Render QR as text characters
• Not detected as image
• Phones can still scan

Redirect Chains

QR → bit.ly → legitimate-looking-redirect.com → phishing.site

Each hop:

• Adds delay for reputation systems
• May use legitimate services
• Final destination not visible initially

Current State

Status: Active (and Evolving)

QR phishing has become a major threat:

Detection Guidance

Email Indicators

Flag emails with:

• Images containing QR codes
• MFA/authentication themes
• Urgency around access expiring
• Request to use mobile device

User Reports

Encourage reporting:

• Unexpected QR codes in business email
• Requests to scan and authenticate
• QR codes for benefits/HR/parking

Post-Click Analysis

If user scanned and entered credentials:

1. Reset credentials immediately
2. Check for MFA bypass (session theft)
3. Review sign-in logs
4. Check for persistence (app passwords, forwarding rules)
5. Determine what was accessed

SIEM Queries

email.has_image = true
AND email.image.contains_qr = true
AND email.sender.domain NOT IN (trusted_domains)
AND email.subject MATCHES (mfa|authentication|verify|expire|action required)