Quishing: The QR-Code Phishing Attack Your Email Filters Miss

Quishing is QR-code phishing: the attacker puts the malicious link inside a QR code image instead of typed text, so your email filter scans the message, finds no bad URL, and lets it through. The victim scans the code with a phone, lands on a fake Microsoft 365 login, and hands over their password and MFA code on a device your security team usually can't see. The fix is a combination of image-aware email filtering, phishing-resistant sign-in, and Conditional Access in M365. None of those is exotic, but most small businesses have none of them turned on.

Why your email filter never sees the link

Most email security still works on text. It reads the body, pulls out every URL, checks each one against reputation feeds and a sandbox, and rewrites the dangerous ones. That pipeline is good at what it does. The problem is that a QR code isn't text. It's a picture. To the filter, an email that says "scan this code to review your held voicemail" with a QR image attached contains exactly zero suspicious links, because the link only exists once a camera decodes the pixels.

I've watched this play out in client mailboxes. The email looks like a routine Microsoft or DocuSign notice. There's a QR code, a short line of urgency, and a real-looking sender. The secure email gateway passed it clean because there was nothing to flag. The malicious destination was never in the message in a form the scanner could read.

Why attackers love the phone in your pocket

Quishing has a second trick that makes it nasty: it moves the victim off the managed laptop and onto a personal phone. When someone scans a code at their desk, the browser that opens is usually their own phone's browser, outside your endpoint protection, your DNS filtering, and your web proxy. The controls you spent money on never get a vote. The phone screen is also small, so the fake URL is truncated and the lock icon looks reassuring, and people are conditioned to scan codes without thinking after years of restaurant menus and parking meters.

The Federal Trade Commission flagged this directly in its December 2023 consumer alert, Scammers hide harmful links in QR codes to steal your information. The mechanics they describe for consumers are the same ones hitting business inboxes, just with a corporate login page at the end instead of a fake parcel-delivery site.

It's really a credential and MFA attack

Quishing is the delivery method. The payload is almost always credential theft against Microsoft 365 or Google Workspace. Phishing and spoofing remain the single most-reported crime type to the FBI's Internet Crime Complaint Center, and QR codes are simply the newest envelope for the same con.

Here's the part that catches people who think MFA saves them. Modern quishing pages run an adversary-in-the-middle proxy. The fake login page is a live relay sitting between the victim and the real Microsoft sign-in. The user types their password, gets the real MFA prompt, approves it, and the attacker captures the resulting session token. With that token, the criminal is logged in as your employee without ever needing the password or a second prompt again. App-based and SMS MFA both fall to this. The myth that "we have MFA, so phishing can't hurt us" is how a lot of mailboxes get taken over.

What happens after the login is stolen

In trucking and logistics, where I do most of my work, a stolen M365 mailbox turns into money fast. The attacker reads the inbox, learns who pays whom, and slips into a live thread about an invoice or a rate confirmation. Then comes the quiet message: the bank details have changed, please send the next payment here. Because it comes from a real internal account, on a real thread, it sails past the recipient's instincts. We watch the top shipper and carrier contacts of our clients specifically because this is where compromised credentials get cashed out.

The attacker also sets a mailbox rule to auto-delete or hide their own replies, so the real employee never notices the conversation happening under their name. By the time anyone spots it, a payment has gone out or a load has been double-brokered.

The controls that actually stop qr code phishing

Start at the inbox. You need email security that decodes QR codes inside images and attachments, follows the link, and detonates the destination in a sandbox. This is the single biggest gap, because the legacy text-scanning gateway most small businesses inherited simply doesn't do it. Microsoft 365 has improved here, but the default tenant configuration leaves real holes, which is why we tune it rather than trust the out-of-box settings.

Next, make the stolen credential worthless. The strongest answer is phishing-resistant MFA. CISA is blunt about this in its Implementing Phishing-Resistant MFA fact sheet: FIDO2 security keys and passkeys are the only widely available form of MFA that an adversary-in-the-middle proxy can't replay, because the credential is cryptographically bound to the real site. If you can't roll out keys everywhere this quarter, prioritize executives, finance, and dispatch first.

Then add Conditional Access. In Microsoft Entra you can require a compliant, managed device for any access to email and finance apps, which kills the whole quishing path: even with a valid token, a login from an unmanaged personal phone gets blocked. Pair it with a policy that re-evaluates risky sign-ins and revokes sessions when the location or device looks wrong.

The boring layer that still matters

Technology gets you most of the way; habits cover the rest. Teach people that a QR code in an email is unusual and worth a pause, especially when it claims a voicemail, a held document, or an MFA "re-enrollment." Run phishing simulations that include QR-code lures, not just link-and-attachment ones, because employees who've only ever been tested on typed links won't recognize the new shape. And give staff a one-click way to report a suspicious message so your team can pull it from every other inbox before someone else scans it.

This maps cleanly to the NIST Cybersecurity Framework 2.0: you're improving Protect with phishing-resistant sign-in and Conditional Access, and Detect with sandboxing and reporting. It's the same fundamentals applied to a delivery method the attackers updated.

My short version for an owner who's busy

If you run a 20-to-200-person company and want the 80/20: turn on email security that actually decodes QR codes, move your highest-risk people to FIDO2 keys or passkeys, and require managed devices for M365 through Conditional Access. Those three changes neutralize most quishing without slowing anyone down. The rest is tuning and training.

If you'd rather have someone set this up and watch it day to day, that's the work we do. Our 24/7 SOC tunes Microsoft 365 against exactly these attacks and pairs it with phishing-resistant sign-in and a guaranteed 4-hour incident-response SLA. You can read how we approach it on the EFROS Microsoft 365 security page, or call us at +1-765-888-8888.