Scammers Deploy QR Code ‘Quishing’ in Email Campaigns to Harvest Logins

Cybercriminals are adding a new twist to classic phishing attacks by embedding QR codes in malicious emails, a technique dubbed “quishing” that aims to capture users' login credentials when the codes are scanned.

The approach replaces a clickable hyperlink with a square graphic that, when scanned by a smartphone, redirects the victim to a counterfeit login page. Researchers say the method exploits a psychological bias: while many people are wary of suspicious URLs, they often trust a QR code as a neutral, technology‑driven shortcut.

QR codes have become ubiquitous in marketing, payment, and contact‑less services, which has lowered the general public’s guard around them. Security firms have observed a rise in email campaigns that pair familiar branding with a QR image, urging recipients to “verify your account” or “confirm your identity” by scanning. Once the victim follows the hidden link, their entered credentials are harvested by the attackers, who can then use them for account takeover or sell them on underground markets.

Industry analysts note that quishing builds on the long‑standing success of phishing, which still accounts for the majority of reported data breaches. The addition of QR codes sidesteps many email filters that flag malicious URLs, and it circumvents the hesitation many users feel toward clicking unknown links. Experts caution that the ease of generating QR codes with free online tools makes the tactic scalable for both low‑level fraudsters and more sophisticated groups.

Security professionals recommend a cautious approach: treat QR codes in unsolicited messages like any other unknown link, verify the sender’s address, and, when possible, manually type the website address instead of scanning. Organizations are urged to educate employees about quishing, update email security gateways to detect QR images attached to suspicious content, and consider deploying mobile device management solutions that can warn users of potentially dangerous scans. As QR technology continues to expand, defenders expect quishing to evolve, making awareness and proactive defenses essential to curb the new vector.