Quishing

Quishing has grown because QR codes bypass several defences at once. Email filters that rewrite and scan links may not decode an image of a QR code. And scanning the code moves the victim from a managed work computer to a personal phone, where web filtering and endpoint protection are usually weaker.

Typical lures include notices to re-register MFA, view a shared document, sign an HR policy, or pay a parking fee. Physical quishing also exists: fake QR stickers placed over legitimate ones on parking meters or restaurant tables.

For businesses, the risk is mainly credential theft. Once an employee enters their Microsoft 365 password and MFA on a phishing page reached by QR code, the attacker can use adversary-in-the-middle techniques to take over the account.

Defences include email security tools that analyze images for QR codes, training staff to be suspicious of any QR code asking them to sign in, conditional access policies that limit where sign-ins can occur, and phishing-resistant MFA, which cannot be relayed through a fake page.