Your email security stack has a blind spot, and attackers know exactly where it is.
Most phishing filters are built to scan text for malicious URLs. So what happens when the malicious URL isn't text at all — it's an image? That's quishing: QR code phishing, and it's currently one of the fastest-growing email attack vectors tracked in 2026.
The mechanics are simple but effective. A phishing email impersonates HR, IT, or a trusted SaaS brand (Microsoft 365 and DocuSign get spoofed constantly), with a QR code sitting in the body or buried inside a PDF attachment instead of a clickable link. The victim scans it with a personal phone — instantly stepping outside corporate EDR, DNS filtering, and browser isolation — and lands on a spoofed login page. Some campaigns skip password theft altogether and go straight for session tokens via OAuth-consent abuse, which can hijack an account without MFA ever failing.
The scale is no longer trivial. ESET's H1 2026 Threat Report clocked quishing at record levels — 100,000+ monthly detections, concentrated in the US, Spain, and Mexico. Microsoft's own Q1 2026 telemetry reported a 146% quarterly increase in QR-based phishing.
In the full write-up, I cover the complete attack chain, the actual detection signature ESET uses (QRCode/Phishing), and a safe way to decode a suspicious QR image for investigation using zbarimg — without ever opening the link in a live browser. Plus concrete prevention steps for both users and security teams.
If you're building or maintaining email security tooling, this is a gap worth checking for.
Read the full breakdown: https://www.xpert4cyber.com/2026/09/qr-code-phishing-emails-steal-login-credentials.html
Top comments (0)