"Quishing" is phishing with a QR code. Instead of a clickable link, the lure shows a QR image - "scan to view your secure document / MFA reset."
Why attackers love it
- Bypasses link scanners - the malicious URL is inside an image, so email security that rewrites/inspects links often never sees it.
- Moves the victim to a phone - personal devices are less monitored, may lack EDR, and small screens hide tell-tale domains.
- Looks legitimate - QR codes are normal in invoices, parking, MFA enrollment.
What the attack does
The QR resolves to a credential-harvesting page (often an Adversary-in-the-Middle proxy that also steals the session token, defeating MFA), or to a malicious app install.
Detect + defend
- Email detection - flag emails that are mostly an image with little text, image-only attachments, or known quishing templates; OCR/QR-decoding gateways help.
- Identity signals - the real payoff shows up as a suspicious sign-in: new device, impossible travel, or AiTM patterns. Watch there too.
- User training - treat "scan this code" with the same suspicion as "click this link," and verify out-of-band.
- Phishing-resistant MFA (FIDO2) neutralizes the token-theft endgame even if a user scans and enters credentials.