Phishing emails with malicious links have been a staple attack for two decades, and email security has adapted accordingly. Most business email platforms now scan URLs in real time, detonate attachments in sandboxes, and block known-bad domains at delivery. The result is that a straightforward “click this link” phishing email gets caught more reliably than it did ten years ago.

Quishing — QR code phishing — exists because attackers found a simple bypass: put the malicious URL inside a QR code image. Email security tools scan text and URLs. They don’t decode images to extract and check URLs embedded in QR codes. The link exists in the email, but your email gateway never sees it.

How Quishing Attacks Work

The mechanics are straightforward:

  1. The attacker sends an email that looks like a legitimate notification — a Microsoft 365 MFA setup prompt, a shared document notification, a DocuSign request, a parcel delivery alert.

  2. Instead of a clickable link, the email contains a QR code image. The call to action is usually something like “scan this QR code with your mobile phone to complete verification.”

  3. The recipient scans the code with their phone camera. Phones decode QR codes natively and open the embedded URL in the mobile browser.

  4. The URL leads to a phishing site — typically a convincing replica of a Microsoft, Google, or Docusign login page.

  5. The victim enters credentials. If MFA is required, more sophisticated attacks use an adversary-in-the-middle (AiTM) proxy that captures the session token at the moment of authentication, bypassing MFA entirely.

The mobile phone is the key element. Scanned on a work mobile, the traffic bypasses corporate DNS filtering and endpoint controls that might catch the visit on a managed laptop. It’s a different device on a different network.

Why Standard Email Security Misses It

Most email security tools — Microsoft Defender for Office 365, Proofpoint, Mimecast — work by:

  • Scanning URLs in email body and headers against threat intel databases
  • Rewriting URLs to route clicks through a sandbox that checks the destination
  • Analysing attachments for malicious content

None of these mechanisms examines the content of QR code images. The image is just a JPEG. The URL is inside the QR matrix as a data pattern, not as text the scanner reads. Standard email security is effectively blind to quishing URLs.

Some newer email security tools have added QR code detection — decoding images to extract and check embedded URLs. But deployment of this capability isn’t universal, and attackers have added mitigations: slight distortions to the QR code, overlaid images, or redirector chains that pass URL reputation checks at delivery time but redirect to a malicious site later.

What Quishing Emails Look Like

The most commonly impersonated contexts in quishing attacks:

MFA re-enrolment: “Your authenticator app needs to be re-registered. Scan the QR code to set up Microsoft Authenticator.” This is effective because MFA setup legitimately involves scanning QR codes — it’s what people expect.

Shared file access: “You’ve been sent a secure document. Scan to access.” Plays on normal business file-sharing workflows.

Parcel notifications: Particularly effective for personal email phishing; less common in business contexts but used in spear-phishing targeting individuals at work.

Payroll or benefits system updates: “HR requires you to verify your direct deposit details via our secure portal.”

The email headers and sending domains in quishing campaigns are often spoofed or use lookalike domains. Where the sender passes basic authenticity checks, the QR code is the primary payload.

Practical Defences

1. Train staff to be suspicious of QR codes in email

This is a specific training point worth covering explicitly — most phishing training focuses on links, not QR codes. The key rule to teach: if an email asks you to scan a QR code to log into anything, treat it as suspicious. Verify through a known-good channel before scanning.

Legitimate services — Microsoft, Google, DocuSign — don’t typically send MFA setup or account verification via email QR codes in normal operation. When they do need to set up MFA via email, there’s usually a process that starts from inside a logged-in session, not from an unsolicited email.

2. Upgrade email security to include QR code analysis

Microsoft Defender for Office 365 Plan 2 includes QR code URL extraction and analysis. Proofpoint and Mimecast have added similar capabilities. If you’re on a basic email security plan, check whether your provider has rolled this out and whether it’s enabled on your configuration.

For Microsoft 365 environments, the setting is in the Safe Links policy — “Scan URLs from QR codes” must be explicitly enabled in many tenants. Check your Anti-phishing and Safe Links policies.

3. Enforce phishing-resistant MFA

The reason quishing is so valuable to attackers is credential harvest — specifically capturing credentials plus session tokens to bypass MFA. FIDO2 security keys and Windows Hello for Business are phishing-resistant forms of MFA because they tie authentication to the legitimate domain. Even if an attacker captures a username and password via a quishing phishing site, they can’t phish a hardware security key authentication.

For most small businesses, hardware keys for every user aren’t practical. Passkeys (supported by Microsoft Entra and Google accounts) are an emerging alternative that provides phishing resistance without physical hardware — credentials are bound to the specific legitimate service domain and can’t be replayed against a fake site.

4. Conditional access policies

If you’re using Microsoft Entra ID or Google Workspace, conditional access policies that require compliant managed devices reduce the risk of quishing attacks via personal mobile phones. An authentication that succeeds on an unmanaged personal device can be blocked from completing if you require device compliance.

This doesn’t eliminate quishing but it means a credential captured via a personal phone can’t be used to access corporate systems without a managed device also being in the equation.

5. DNS filtering on mobile devices

Corporate DNS filtering (Cloudflare Gateway, Cisco Umbrella, NextDNS for business) can be extended to mobile devices via configuration profiles on managed phones. If the quishing URL resolves to a known phishing domain, DNS filtering can block the connection. This closes part of the mobile-device gap.

Reporting Quishing Attempts

If staff receive quishing emails:

  • Report the email to your IT provider or MSP — they can analyse the QR code and check whether it’s a targeted attack
  • Forward to the UK’s National Cyber Security Centre via report@phishing.gov.uk
  • Use Microsoft’s “Report Phishing” button if you’re on Microsoft 365 — this feeds into Microsoft’s threat intelligence
  • Document the sending domain and any other indicators for your security logs

What This Doesn’t Fully Solve

QR code image analysis in email security tools has an arms race dynamic. Attackers are already experimenting with QR code obfuscation — visual noise, partial rendering, multi-redirect chains — to defeat image-based detection. The technical controls will improve; attackers will adapt.

The most durable protection is phishing-resistant authentication combined with staff who know to treat unsolicited QR codes in email with the same suspicion they apply to unexpected links. Quishing is a link-in-an-image — the social engineering playbook is the same, only the delivery mechanism is different.

References