Quishing is phishing that uses a QR code instead of a clickable link. The code leads to a fake login page or a malicious download. The UK NCSC uses the term for QR codes in phishing emails and has reported an increase in these attacks.

How it works

• The attacker places a QR code in an email, PDF, letter, poster or parking meter sticker.
• The message gives a reason to scan, such as an MFA reset, a parcel delivery or an unpaid fee.
• The victim scans with a phone, which may have weaker protection than a work computer.
• The link opens a page that copies a known brand and asks for credentials or payment details.

Because the link is inside an image, some email security tools that check links do not see it. MITRE ATT&CK covers the delivery of malicious links under T1566.002, Spearphishing Link.

Why it matters for defenders

Quishing moves the attack from a managed computer to a personal phone, which reduces what security teams can see. Staff should treat unexpected QR codes with the same care as links, use the phone’s built-in scanner that shows the address before opening, and report suspicious codes. Fake pages often sit on lookalike domains, so monitoring for phishing and lookalike domains helps catch them.

Sources: NCSC blog: QR codes – what’s the real risk?, MITRE ATT&CK T1566.002: Spearphishing Link