Cybercriminals are quick to find new ways around security. One of the easiest tricks is using what people already trust. QR codes are now part of payments, logins, and everyday tasks. That makes them an appealing target for attackers. A growing scam called quishing turns a simple scan into phishing or malware, putting both data and accounts at risk.
What Is Quishing?
Quishing, also known as QR code phishing, is a cyberattack that relies on QR codes to mislead people into giving away sensitive data or opening malicious websites. Instead of clicking a suspicious link, an employee might scan a code in an email or on a printed invoice. That single scan can open a fake login page, launch malware, or give attackers access to company systems.
Quishing is no longer rare. A 2024 KeepNet Labs study found that 26% of all malicious links are now sent via QR code. Another report from NordVPN revealed that 73% of Americans scan QR codes without verifying their source, with over 26 million having already visited malicious sites. As QR codes become a regular tool in workplaces and customer transactions, quishing is emerging as a serious business risk.
How Quishing Works
Quishing attacks follow a straightforward approach: present a QR code that looks harmless, convince someone to scan it, and redirect them into a phishing attempt. At its core, it remains phishing, but QR codes alter the attack’s progression. Traditional email filters and secure gateways look for suspicious links. By hiding the destination inside a QR image, attackers can bypass those defenses and reach the user directly.
Once scanned, the code may lead to a spoofed website, open a fake login page, or trigger a malware download. To the victim, it feels routine, such as checking a document or confirming an account. In reality, that scan guides them into handing over credentials or exposing their device to compromise. Understanding these steps helps explain why the tactic is so effective.
How Attackers Deliver Malicious QR Codes
Delivery is where attackers have the most flexibility. QR codes can appear in many different places, both digital and physical, which makes them harder to police.
- Phishing emails: QR codes may be embedded in the body of an email or attached as images. Because the URL is hidden, these messages can slip past filters.
- Printed materials: Stickers with harmful codes may be placed over legitimate ones on posters, menus, or public signs, making them appear authentic at a glance.
- Business documents: Forged invoices, shipping notices, or event flyers may include QR codes that look routine but redirect to malicious sites.
A recent example came from Northwestern University, where phishing emails with QR code attachments directed staff to malicious websites that stole login details. The campaign bypassed normal email warnings and prompted the university to issue an alert to its community. Because QR codes appear harmless, people often scan first and think later.
Other real-world scams have used QR codes on parking meters, restaurant menus, package delivery notices, and even crypto wallet transfers. Each case shows how attackers take advantage of trusted or routine settings to push victims toward malicious sites.
Fake Login Pages Can Steal Credentials
A common result of scanning a malicious QR code is landing on a fake login page. These spoofed sites often mirror Microsoft 365, banking portals, or even a company intranet. Because the design looks familiar, employees may type in their usernames and passwords without hesitation, giving attackers immediate access. Some pages also run hidden code that installs malware, turning one careless scan into both a stolen account and a compromised device.
Why MFA Alone Doesn’t Stop Quishing
Multi-factor authentication (MFA) is a valuable safeguard, but it is not a complete solution against quishing. When attackers control a fake login page, they can request both a password and the one-time MFA code. Victims believe they are completing a normal login process, but in reality, both factors are being handed over.
In addition, if malware is delivered during the attack, MFA offers no protection at all. A compromised device can be used to hijack active sessions, giving attackers access without needing to bypass authentication codes. For businesses, the lesson is clear: MFA lowers risk, but it cannot be the only defense. A layered approach that includes employee awareness and technical safeguards is essential.
Advanced Quishing Methods Targeting Business Accounts
Most quishing attacks use spoofed websites or fake login pages. Others go further with advanced techniques aimed at taking over business accounts directly. These methods take advantage of the way QR codes are used for authentication and system access. While they are less common, they are more dangerous because they bypass defenses that many companies rely on.
QRLjacking and Session Hijacking
QRLjacking is an attack that targets quick response login (QRL) systems. These systems allow users to scan a QR code for sign-in, eliminating the need to type a password. Unfortunately, attackers can replace the real QR code with a malicious one that looks legitimate. When an employee or customer scans it, the attacker intercepts the login and takes control of the account without ever needing the password.
Another risk is session hijacking. That happens when attackers steal or copy an active login session. Once they are inside, they can access email, collaboration tools, or cloud platforms just like the real user. For a business, even one hijacked session can expose sensitive data, disrupt daily operations, or allow attackers to gain more privileges across systems.
Other Types of QR Code Exploits
QRLjacking and session hijacking are not the only advanced threats. Attackers continue to find new ways to use QR codes for sophisticated attacks:
- Near-field technology (NFC): Some attacks pair QR codes with NFC prompts to trick users into connecting to fake networks or authorizing payments.
- Account takeover campaigns: Malicious codes can be linked to credential theft or multi-step phishing that gives attackers ongoing access.
- Exploit kits: Tools are now available that make it easier for attackers to generate fake codes and capture login sessions at scale.
Not all QR codes pose the same level of risk. Static codes are fixed and cannot be changed once created. Dynamic codes, however, can be updated after distribution. While this makes them useful for businesses that want flexibility, it also means a code that was safe at first can later be redirected to a malicious site. This ability to change destinations after a code is already in circulation makes dynamic codes especially risky if compromised.
How Quishing Differs From Traditional Phishing
Quishing has the same goal as phishing: tricking someone into giving away information or access. The difference is in delivery. Instead of clicking a link, users are asked to scan a QR code. Because the destination is hidden inside the image, many secure email gateways and filters fail to block it.
Traditional phishing often depends on suspicious links or attachments, which filters are designed to catch. Quishing bypasses those defenses because a QR code looks harmless, even though it may redirect to a malicious website. Messages also rely on emotional triggers, such as urgent warnings, fake deadlines, or offers that seem too good to be true. These tactics push people to scan quickly without stopping to think.
The impact also feels more immediate. A phishing email usually requires a click before reaching a fake site, but a quishing attack takes victims there the moment they scan. That can mean landing on a spoofed login page or triggering malware without warning. Both rely on social engineering, but quishing exploits a blind spot many businesses are not prepared for.
Why Quishing Is Growing Among Cybercriminals
Quishing is spreading because it gets past defenses that stop many phishing attempts. Spam filters and secure gateways are built to catch suspicious links, but they rarely block QR codes. A single scan can open the door to credential theft or financial fraud. It can also trigger malware that compromises a device. With QR codes now used for payments, logins, and daily business tasks, attackers are eager to take advantage of the trust people place in them.
Several trends explain why quishing is spreading quickly:
- Brand impersonation: Fake codes are designed to look like they come from trusted companies, such as banks or Microsoft.
- Banking and payment details: QR codes on fake invoices, parking ticket scams, or payment portals can be used to steal funds.
- Emotional manipulation: Messages that create urgency or pressure push people to scan without thinking.
- Security gaps: Many mobile devices lack strong security software, so scans are less likely to be flagged as malicious.
The growing scale of these scams has also drawn attention from regulators. The Federal Trade Commission (FTC) and the U.S. Postal Inspection Service (USPIS) both issued alerts in 2025, warning businesses and consumers to be cautious when scanning unsolicited QR codes in emails, packages, or public spaces.
These factors combine to make quishing a growing threat. It uses the social engineering of phishing, but delivers it in a less obvious way. As QR codes become more common in business operations, the risks will only increase.
How to Spot a Quishing Attack Before It’s Too Late
The best defense against quishing is learning how to spot it. Attackers rely on speed and trust. If someone scans without pausing to think, the scam often works. Knowing the visual red flags, using the right tools, and recognizing pressure tactics can stop many attacks before they lead to an account takeover or data breach.
Signs of a Fraudulent or Tampered QR Code
Recognizing a malicious QR code often comes down to noticing small details that feel out of place. A few warning signs to watch for include:
- Poor print quality: Legitimate codes from businesses are usually clear and sharp. A blurry or distorted code may have been copied or altered.
- Misaligned placement: A code that appears to have been added later, taped over another, or does not align with the surrounding design can be a sign of tampering.
- Missing branding or context: Real codes usually appear with a logo, label, or short explanation. If a code stands alone with no clue what it does, it deserves caution.
- Out-of-place location: While attackers often place codes in public spaces, the red flag is when the setting does not match the purpose, such as an unmarked parking meter or a random flyer in a hallway.
Employees trained to notice these details are less likely to scan without thinking. By pairing this awareness with security awareness training, organizations reduce the chance of malicious QR codes leading to a breach.
Tools That Help Catch Malicious QR Links
Technology can add an important layer of protection. Some secure QR scanners preview the destination before opening it, which lets users back out if it looks suspicious. Mobile security software can also check links against threat feeds and block malicious sites. At the organizational level, advanced email security and Microsoft 365 safeguards can flag risky messages or unusual sign‑ins before employees engage.
Traditional tools still miss some attacks. Most email defenses analyze text, URLs, and attachments, while QR codes arrive as images. Unless the platform decodes the image and inspects the embedded link, the destination can slip through. Newer solutions address this gap by scanning QR codes directly, reducing risk before anyone scans.
Ultimately, Attackers Want You To Scan Without Thinking
Always remember: urgency is a red flag. A message may warn of a missed payment, a locked account, or an expired service. Flyers might urge you to scan immediately for a discount or to avoid a penalty. This pressure is deliberate because attackers know rushed decisions lead to mistakes. Training staff to recognize urgency cues, combined with device policies and two-factor authentication, helps employees slow down, think first, and avoid being tricked into scanning a malicious code.
What to Do if You Accidentally Scan a Malicious QR Code
Even with training and tools in place, mistakes can happen due to human error. If an employee scans a malicious QR code, quick action can limit the damage and prevent a complete account takeover. Businesses should have clear steps in place so staff know exactly what to do.
Step 1: Do not enter any information. If a code opens a login page or payment screen, stop immediately. Entering credentials or banking details is what turns a scan into a compromise.
Step 2: Disconnect and report. If you suspect a device has started a download or shown unusual behavior, disconnect it from the network. Report the incident to IT or security staff right away so they can investigate.
Step 3: Run a security scan. Use company-approved mobile security or endpoint protection tools to check for malware. IT teams may also run additional scans to confirm the device is clean.
Step 4: Reset credentials. If login details were entered, change those passwords immediately. Enable two-factor authentication if it is not already in place. That helps reduce the risk of account takeovers.
Step 5: Monitor accounts and systems. Watch for unusual account activity or unauthorized changes. IT teams may also use dark web monitoring tools to see if stolen credentials are being sold.
Step 6: Report externally if needed. In some cases, incidents should be reported to the Federal Trade Commission (FTC) or industry regulators, especially if personal or financial data may have been exposed.
Step 7: Review and train. Use the incident as a training opportunity. Reinforce security awareness training and device policies so employees feel prepared to handle similar threats in the future.
Awareness Is the Best Defense Against QR Code Scams
Always remember that urgency is a red flag. A message may warn of a missed payment, a locked account, or an expired service. Flyers might urge you to scan immediately for a discount or to avoid a penalty. This pressure is deliberate because attackers know rushed decisions lead to mistakes. Training staff to recognize urgency cues, combined with device policies, helps employees slow down, think first, and avoid being tricked into scanning a malicious QR code.
Quick Quishing Prevention Checklist:
- Pause before scanning codes from unknown sources.
- Check for tampering or poor print quality.
- Look for branding or an explanation alongside the code.
- Use a secure QR scanner that previews links.
- Treat urgent or fear-based language as a red flag.
- Report suspicious codes to IT or security teams.
Businesses don’t need to face these risks alone. ITonDemand helps organizations strengthen defenses against threats like quishing with tailored security awareness training, technical safeguards, and ongoing support. With the right partner, you can build a workforce that recognizes threats early and a system that stops attacks before they cause damage.
