Quishing has become one of the fastest-growing threats within phishing. The idea is simple: a seemingly harmless QR code hides a fraudulent address. Microsoft has quantified this growth: in March 2026, it detected 18,7 million such attacks , compared to 7,6 million in January, representing a 146% increase in just three months.
The problem lies in actions that have become part of our daily routine. Scanning a restaurant menu, paying for parking, downloading a ticket, or looking up tourist information has become commonplace. Cybercriminals exploit this familiarity. Experts from Áudea, the cybersecurity unit of Logicalis Spain, emphasize that the web address remains hidden until the link is opened, thus reducing the warning signs that a user might detect at first glance.
Why a QR code hides the deception and jumps from computer to mobile
Unlike a text link, a QR code doesn't display the URL before scanning. Andrés Cartes Guilarte, Cybersecurity Culture Consultant at Áudea, points out that this opacity is one of the biggest advantages for attackers. The user can't verify if the destination is legitimate, and in many cases, the scan is done from a mobile phone , which moves the interaction outside the corporate computer and beyond the company's security controls.
Once the link is opened, the victim may end up on pages that mimic corporate services, banking platforms, or authentication screens. The objective depends on the type of fraud, but it usually involves obtaining credentials, personal data, or financial information . This impersonation is more believable when the message arrives in a familiar context, such as a supposed internal communication or a notification from an entity the user regularly uses.
Microsoft also identified approximately 8.300 billion phishing threats distributed via email during the same period. The company described quishing as the fastest-growing attack vector during that time, a trend that aligns with the expanding use of QR codes across all types of environments.
PDFs, emails, and Microsoft 365 documents: the preferred channels
Barracuda's 2026 Email Threats Report reveals several striking findings. 70% of the malicious PDFs analyzed contained QR codes that led to phishing pages. In other words, the document acts as a disguise to trick the victim into trusting the file and not suspecting the code inside.
The same report details that 56% of malicious Microsoft 365 documents included quishing. Furthermore, codes embedded directly into the body of emails increased by 336% in March 2026. Attackers aren't limiting themselves to attachments: they're also placing the QR code within the message text itself to increase the chances of someone scanning it.
ESET's Threat Report H1 2026 indicates that up to 11% of all phishing attacks in the first half of the year were carried out using the quishing method. The firm warns that these techniques are becoming more sophisticated: some campaigns aim to obtain multi-factor authentication tokens, install malware, trick victims into downloading malicious apps, or use legitimate phone apps as part of the scam.
Josep Albors, Head of Research and Awareness at ESET Spain, explains that attackers can further disguise the code by embedding it in PDFs, JPEG images, or other documents , or by using services that shorten URLs before generating the QR code. At the same time, the message accompanying the code can contain very little text, eliminating classic clues such as spelling errors, visible links, or unusual domains.
From the restaurant menu to the parking lot: physical risk and defense measures
The danger doesn't stop at your inbox. QR codes placed in restaurants, shops, public transport, parking lots, and tourist services present the same problem: you can't check which page they will display before scanning them. Furthermore, in public spaces, the code may have been tampered with or replaced with a fraudulent one.
In August, INCIBE documented a real-life case that perfectly illustrates the risk. A user scanned a restaurant menu's QR code and, after clicking the link and accepting a pop-up window, inadvertently activated an unsolicited premium subscription . Other customers at the same establishment experienced similar situations, demonstrating that the problem was not an isolated incident involving a single individual.
The expansion of this technology explains part of the phenomenon. According to data compiled by QR TIGER, around 75% of restaurants worldwide already use QR codes to facilitate access to digital menus. The use of this tool in marketing and advertising grew by 323% between 2021 and 2023, a figure that helps explain why criminals have focused on it.
For businesses, ESET recommends including quishing in awareness programs and simulation exercises so that employees learn to recognize suspicious QR codes. It also advises against scanning codes in unsolicited emails and recommends reporting any suspicious messages.
When an employee believes a message comes from a reliable source, it's advisable to verify it through an independent channel , using contact information not found in the email itself. This verification prevents confirmation from relying on information sent by the potential attacker.
Technical protection also matters. Among the measures mentioned are email security solutions, mobile security tools, device management via MDM, phishing-resistant multi-factor authentication , the principle of least privilege, just-in-time access, regular updates, and monitoring for anomalous behavior. In addition, it is essential to test incident response plans to ensure a rapid response should an attack occur.
- Email and mobile security to block malicious links and code.
- MDM Device Management to apply minimum policies.
- Phishing-resistant MFA and the principle of least privilege.
- Updates, just-in-time access and continuous supervision.
The pattern revealed by all these figures is clear: QR codes have found a niche in daily life because they are convenient, fast, and ubiquitous. This very ubiquity is what makes it a difficult threat to detect. The key is to be wary of the unexpected , check the context before scanning, and implement security measures that accompany the user from email to mobile devices, including documents and physical spaces.
