QR Phishing Bypasses Email URL Scanners by Encoding Malicious Links Inside Images

QR-code phishing, also known as quishing, is becoming a major email security concern as attackers hide malicious links inside images instead of placing them directly in message text.

Traditional email security tools often inspect URLs in the email body, sender reputation, attachments, and known malicious domains. However, a QR code is an image containing encoded data.

When the harmful URL is embedded inside that image, basic URL-scanning systems may not detect it before the email reaches a user’s inbox.

The attacker’s goal is simple: persuade a recipient to scan the QR code with a smartphone. The victim is then sent to a phishing page that can steal Microsoft 365, banking, VPN, or other corporate credentials.

Since the scanning and browsing activity happens on a personal or mobile device, it may also occur outside the organization’s protected network and security controls.