QR codes—those little arrays of black and white squares we scan with our smartphones—quickly turned from convenient to risky. As businesses increasingly adopt their use, especially since COVID-19 accelerated contactless tendencies, QR code phishing (aka quishing) has staked its claim in the cyber-threat landscape. 

In September 2023, ReliaQuest saw a 51% increase in quishing attacks, as compared to the cumulative figure for January through August 2023. This spike is at least partially attributable to the increasing prevalence of smartphones having built-in QR code scanners or free scanning apps; users are often scanning codes without even a thought about their legitimacy.  

The impacts of quishing can be severe: financial loss if banking login credentials are exfiltrated, malware deployment that leads to operational disruption, and/or data loss. Let’s go over four techniques that threat actors are using to increase their quishing success, and how to mitigate them.  

Quishing Technique 1: Make the Target Sweat 

Quishing methods often overlap with standard phishing protocol (learn about the latter, and how to automate your phishing playbook, here). Targets receive an email from a purportedly legitimate sender, who encourages them to scan the embedded QR-code image. The attacker usually tries to create a sense of urgency, such as foreshadowing dire consequences if the recipient doesn’t comply.  

Case in Point 

In August 2023, ReliaQuest investigated an email received by an employee of an educational institution. The sender had spoofed the institution’s domain, and the email contained a QR-code image leading to a URL that resolved to a location in Russia.  

The domain hosted a page masquerading as the customer’s web application. Had the employee actually fallen for the attack and navigated to that page, they would have been prompted to provide the login credentials for all their professional accounts or face purported account deletion. No compromise was achieved, in this case. On to the next technique.

Quishing Technique 2: Pose as a Legit Entity  

Quishing emails typically mimic the branding and personas of legitimate technology or banking organizations. In some instances, mimicking isn’t even necessary: The attacker has already compromised an email account belonging to an organization and can then send a message from the entity’s legitimate domain. 

Those unfortunate recipients who scan the QR code typically find themselves on a landing page that asks for their banking or security credentials.  

In the past 12 months, around 56% of quishing emails detected in ReliaQuest customer incidents involved Microsoft two-factor authentication (2FA) resets or enablement. Recipients were encouraged to enter their Microsoft email address and password. Online banking pages were also a popular method, used in 18% of the emails from that period.  

Quishing: Word on the Street

On cybercriminal forums, quishing chatter is getting louder. On several occasions, ReliaQuest has witnessed forum members sharing links to QR-code generators or articles about quishing techniques. One member even shared a complete guide to QR code phishing (practically a written invitation for novice quishers). Another member suggested using an adversary-in-the-middle phishing technique: sending QR codes via Telegram, to lead unwitting users to a malicious domain intended to target cryptocurrency exchange platforms where all interactions will be monitored by the threat actor.

Quishing Technique 3: Smuggle the Code 

Attackers can hide a QR code in a PDF or JPEG file attached to the quishing email, rather than in the email body. With a benign—or even blank—message body, there’s less chance that email filters will flag the message. (Those filters don’t extract embedded URLs from image files, yet.) Smuggling in attachments appeared in 12% of the quishing incidents we sampled in the past 12 months.  

Case in Point 

In July 2023, a quishing email was sent to a healthcare company’s employee from a compromised account associated with a legitimate third party. The email body was empty, but the text in the PNG file directed the user to scan the QR code it contained, using their mobile device. This was likely an effort to steer them away from the safety of their corporate network, where any associated proxy traffic would be logged.  

A scan would lead to a malicious landing page that looked like the customer’s login page. By decoding it, we identified an open-redirect phishing technique using base64 to pass parameters, such as the recipient’s email address, name, and organization. That technique not only changes a landing page based on the arguments, but also makes it appear as though user credentials are cached. (We talk more about open redirect attacks here.)  

This quishing incident is typical of large-scale, credential-harvesting campaigns, and the employee was probably one of many targets.  

Quishing Technique 4: Redirect the Target 

QR-code scanning apps often display the encoded link before asking the user whether they want to navigate to it. Quishing attackers work around this, such as by redirecting the scanner to trusted domains of legitimate services, and/or to typo-squatted URLs. We saw that kind of activity in 18% of quishing attacks sampled in the past 12 months.  

Case in Point 

An August 2023 spearphishing campaign used a malicious QR code in an email to the CEO of a US-based healthcare organization. The email header read: “[POTENTIAL PHISH] [External] 5 Undelivered Emails from [client name redacted].” The sender used the domain of a legitimate Spain-based steel company.  

The email body featured a fake Microsoft 365 logo, and the recipient was encouraged to scan a QR code to receive allegedly undelivered emails. The domain that QR code directed to would quickly steer the scanner through two different domains, to eventually land on a third, malicious, page. 

Defending Against Quishing  

QR code phishing is still relatively new, but it’s likely to gain ground as more threat actors learn how difficult it is for enterprises to defend against the threat. Future quishing attacks will probably be even more widespread and sophisticated.  

It’s difficult to detect QR code attacks via email filtering methods: The malicious activity often takes place on a mobile device, and email-filtering tools can’t scan QR codes yet. Detection of QR codes depends largely on the email app a victim uses and the alerts it generates.  

However, ReliaQuest’s GreyMatter Phishing Analyzer (GMPA) can extract and analyze encoded URLs found in QR codes, focusing on the most common image MIME types: JPEG and PNG. GMPA extracts the embedded and attached images from the reported email, then transforms them through a barcode reader. If QR code text is present, the system extracts the text and looks for URLs. Identified URLs are then fed through our analyzers for deeper analysis. 

There are also several other steps you can take to minimize the threat of quishing:  

  • Educate staff and conduct regular phishing simulation exercises—including modules on quishing. The idea is to encourage email recipients to spend more time analyzing the legitimacy of messages they receive.
  • Implement email inbox rules that highlight messages from external senders, to help flag potentially malicious emails to employees. Block or flag emails that contain no body text.
  • Use multifactor authentication (MFA). But remember that attackers can sometimes bypass MFA; check out the relevant recommendations in our MFA bypass blog.