Quishing at Work: Why Your Email Gateway Can't See QR Phishing

Most writing about QR phishing is aimed at consumers: don't scan random stickers, check the URL, be careful. Useful advice, and we've covered it for individuals in are QR codes safe.

This is the other article — the one for people who have to defend an organisation. Because in that context, quishing isn't a scam to be alert about. It's an architectural problem, and awareness training is close to the least effective control you have.

Here's what the 2026 data actually shows, including the part vendors leave out.

Why this attack exists at all

Traditional email security inspects URLs. It extracts links from message text and anchor tags, checks them against reputation databases, rewrites them, detonates them in a sandbox.

A QR code is an image. The URL lives inside a pattern of light and dark squares. A text-parsing engine sees a picture and moves on.

That's the first gap, and it's the one everyone talks about. It's also the less important one, because it's fixable — modern platforms now optically decode QR images and run the extracted URL through the same pipeline as any hyperlink.

The second gap is the real problem, and it cannot be closed.

The email arrives in a protected inbox on a managed corporate desktop. The user picks up their personal phone and scans. The credential harvesting page loads in a personal browser, on an unmanaged device, outside your endpoint protection, your web proxy, your DNS filtering, your DLP policies and your conditional access.

The attack physically leaves your perimeter, mid-execution, by design.

One threat intelligence analysis of roughly 200 QR phishing attacks that successfully bypassed Microsoft Defender E3/E5 and leading secure email gateways found that 100% of them exploited this mobile scanning gap. Not most. All of them.

That's what makes quishing structurally different from a malicious link. A link in an email body can be rewritten, sandboxed, or blocked at the proxy. A QR code scanned by a personal phone routes around all of it.

The 2026 numbers, including the inconvenient ones

Microsoft Threat Intelligence publishes quarterly email threat data, and 2026 has been genuinely volatile.

Q1 2026 (January–March). QR code phishing was the fastest-growing attack vector of the quarter, rising from 7.6 million attacks in January to 18.7 million in March — a 146% increase, and the highest monthly volume in at least a year. Within that: a 35% decline in January, then +59% in February and +55% in March.

Delivery was overwhelmingly attachment-based. PDF attachments grew from 65% to 70% of QR attacks over the quarter. A late development worth noting: QR codes embedded directly in email bodies surged 336% in March, though they remained just 5% of volume.

Q2 2026 (April–June). And here's the part almost no vendor blog mentions: it went down. QR phishing declined for three consecutive months — 17.4 million in April, then −38% in May and −22% in June, closing the quarter at 8.3 million, back to levels last seen in mid-2025.

The cause was largely a takedown. Microsoft's Digital Crimes Unit disrupted the Tycoon2FA phishing-as-a-service platform in early March. Phishing volume linked to that platform fell 92% from its pre-disruption baseline — from an average of 15.1 million messages a month in the second half of 2025 down to 1.2 million by June. The share of QR campaigns redirecting to Tycoon2FA domains fell from a peak of 33% in November 2025 to 14% by June.

Delivery format also shifted: PDF dominance weakened from 79% in April to 58% in June, while DOC/DOCX rose to 40%. Email-embedded QR codes effectively disappeared. Operators rotate formats constantly, which is itself a defensive lesson.

What to take from this. Two things, and they pull in opposite directions:

1. Quishing volume is not on a permanent exponential climb. It responds sharply to enforcement action. Anyone showing you only the +146% figure is telling you half the story.
2. No single service replaced Tycoon2FA at comparable scale during Q2 — but the structural gap that made the attack attractive is untouched. Disruption bought time, not a fix.

Treat the volume numbers as weather. Treat the architecture as climate.

Why detection is genuinely hard

Beyond the image-parsing issue, quishing has properties that defeat the way phishing detection has always worked.

Campaigns don't look alike. Traditional phishing campaigns share 85–95% similarity, which is what makes signatures effective. Analysed QR campaigns average around 0.209 Jaccard similarity — and 0.134 for targeted campaigns — well below the ~0.30 threshold at which pattern matching stops functioning. Tune aggressively and you drown analysts in false positives; tune cautiously and you accept a high miss rate. One major vendor's own guidance recommends a 90% detection threshold for QR analysis, which is to say: openly accepting a 10% miss rate, because higher sensitivity is unworkable.

The infrastructure is trusted. Around 68% of analysed attacks chained through legitimate services — AWS, Cloudflare, Google Cloud, Azure — stacking two or three redirect hops. Blocking the domain isn't an option when the domain is s3.amazonaws.com.

Domains are disposable. Roughly 67% of malicious domains were registered within 30 days of use, with operators typically launching only two or three attacks per domain before rotating. Blocklists are always behind.

The format itself mutates. In January 2026, 12% of attacks used QR codes rendered as ASCII text characters rather than images — bypassing image analysis entirely, because there's no image to analyse.

Meanwhile the human side offers little help: research indicates around 73% of users scan QR codes without verifying the destination, and the average time-to-click on a phishing payload is about 21 seconds. There is no realistic training programme that beats a 21-second decision window with a 73% baseline.

Where the codes actually arrive

Two channels, and most programmes only defend one.

In attachments. Barracuda's analysis of over 3.1 billion emails found 70% of malicious PDFs and 56% of malicious Microsoft 365 documents contained QR codes. PDFs are trusted, rarely blocked, and central to normal business workflows — invoices, signature requests, HR documents. If your email security doesn't fully detonate PDFs and inspect embedded images, QR-in-PDF is a straightforward blind spot.

On physical surfaces. Stickers placed over legitimate codes: parking meters, EV charging stations, restaurant menus near office buildings, conference room booking tablets, event materials. An employee scans something they have every reason to believe is legitimate, and lands on a credential page styled to match your identity provider.

The lure themes that dominate are boringly predictable, which is useful:

• MFA reset or re-enrolment. Fake Microsoft Authenticator, Okta or Duo setup notices. The threat of account lockout drives high scan rates. This is the highest-volume category.
• E-signature requests. DocuSign-style notifications with a QR code instead of a link, usually inside a PDF.
• HR and payroll. Tax document access, open enrolment, direct deposit changes.
• Package delivery. Perennial, and effective because it's plausible for everyone.

Note the irony driving all of this: QR codes are now legitimately used for MFA enrolment, document signing and identity verification. That genuine adoption is exactly what lowers suspicion.

What actually works, in order

1. Phishing-resistant authentication. This is the control that makes the rest survivable.

FIDO2 security keys and passkeys bind the authentication response to the legitimate domain. A user who scans a malicious code, lands on a convincing fake login page and tries to authenticate will find their authenticator simply refuses — the origin doesn't match what was registered. The credential cannot be phished because there is no credential to type.

Given that credential theft is the objective of 89–95% of payload-based attacks, removing the value of stolen credentials addresses the outcome rather than the delivery. Deploy passkeys and, where you can't, conditional access with device compliance requirements so that credentials harvested from attacker infrastructure can't be used.

Note that this also defeats adversary-in-the-middle kits, which increasingly ship with MFA bypass — roughly 48% of observed phishing kits include it, and 90% of high-volume campaigns now use kit infrastructure, up from 30% in 2024.

2. Verify your email security actually decodes QR codes — and that it's switched on.

Microsoft Defender for Office 365 Plan 2, Proofpoint TAP, Abnormal, Mimecast and Perception Point all offer QR extraction and inspection. The recurring finding across incident reviews is that the capability is available in the tenant but not enabled.

Test it rather than assuming. Send a QR code containing a known-safe URL through your gateway and confirm the embedded link appears in your logs and was checked. Then test the same thing inside a PDF attachment, which frequently takes a different processing path than an inline image.

3. Extend controls to the device that does the scanning.

Deploy DNS filtering to managed mobile devices through your MDM. When a user scans on a managed phone, the resulting lookup passes through your DNS security layer even if they used the native camera app. This is the only control that operates where the attack actually executes.

It doesn't help on genuinely personal devices — which is the honest limit of this approach, and a reason to think carefully about how much your access model depends on unmanaged phones.

4. Train for the specific vector, and measure two numbers.

Awareness training is worth doing and should not be your primary control. If you run simulations, use quishing-specific templates and report two separate metrics:

• Scan rate — how many people scanned. This measures awareness of the vector.
• Credential submission rate — how many people entered credentials on the landing page. This measures actual risk.

Reporting only the first flatters you. A realistic quishing lure achieves high scan rates even among security-aware staff, which is exactly why the second number and the passkey rollout matter more.

Give people one concrete instruction that survives a 21-second decision: pause before scanning any QR code you did not explicitly request, check the URL preview before tapping, and report it. Not "be careful" — a specific trigger and a specific action.

5. Watch for the signal you'll actually get first.

Because credentials are harvested outside your perimeter, your first indicator is usually not a blocked email. It's an anomalous sign-in. Around 34% of organisations experience at least one account takeover incident per month, so tune identity-side detection accordingly: impossible travel, new device registration, unusual MFA method enrolment, mailbox rule creation.

If your gateway reports a low phishing detection rate while image-based threats pass through unscanned, your metrics aren't good news. You're not catching more; you're seeing less.

The first hour after a suspected compromise

Because the credential theft happens off your network, your response starts later than you'd like. A workable sequence:

Revoke sessions, not just passwords. Modern kits steal session tokens, not only credentials. Resetting the password while leaving the session alive changes nothing. Revoke all active sessions and refresh tokens for the account.

Check for persistence before anything else. Attackers move fast — median time from initial compromise to extortion has dropped to under a day in some measurements. Look for newly registered MFA methods, new device enrolments, OAuth application consents, and mailbox forwarding or inbox rules. A rule that silently moves messages from your finance team to an archive folder is the classic follow-on.

Assume the mailbox was read. Scope what was in it: pending invoices, supplier contacts, internal threads worth impersonating. Account takeover is usually a staging step for business email compromise against your partners, not the objective.

Find the other recipients. A quishing email is rarely sent to one person. Search the mail flow for the same attachment hash, the same sender infrastructure and the same subject pattern, then check whether anyone else scanned — which you generally cannot see directly, making proactive password and session revocation for the whole recipient list the safer call.

Capture the code before you delete the email. The decoded URL and the redirect chain are the useful indicators for blocking and for telling your provider what got through.

The honest summary

Quishing works because email security was built on the assumption that URLs are text, and because the scan moves the attack onto a device you don't control. The first assumption is now fixable. The second isn't.

So the defence has two tracks, and only one of them is about email:

• Make sure your gateway optically decodes QR codes, in bodies and in attachments, and confirm it's enabled.
• Make stolen credentials worthless, through phishing-resistant authentication and device-bound access.

Everything else — blocklists, signatures, awareness posters — is useful margin around those two.

One last note, since we build a QR code generator and it would be dishonest not to say it: none of this is a problem with QR codes. A code is a link written in a different alphabet. The failure is that our security architecture reads one alphabet and our users read the other, on a device nobody is protecting.