How QR-code phishing can slip past corporate security measures

1. Executive summary

QR-code phishing ("quishing") is an active and growing attack vector in which threat actors embed malicious URLs in QR codes delivered via email, bypassing traditional email security filters that cannot extract or inspect URLs from visual patterns. According to the ESET Threat Report H1 2026, malicious QR codes were present in 11% of all phishing email in the first half of 2026. The core risk to EMEA financial services is the transition of the interaction from a managed corporate endpoint to a potentially unmanaged personal mobile device, defeating business-grade security controls and enabling credential theft, MFA token harvesting, and sideloaded malware. No verified CVE data, CISA-KEV entries, or named threat actor attributions are associated with this item.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While quishing could ultimately lead to an ICT-related incident triggering DORA Art. 17–19 or NIS2 Art. 23 reporting obligations, the advisory itself describes a general threat technique, not a specific incident at a client. Generic mappings to incident management articles would apply to virtually any security advisory and do not meet the specificity threshold.

3. Technical analysis & attack chain

Attack chain (confirmed from source)

1. Initial access vector — email delivery. The attacker sends a phishing email containing a QR code. The QR code replaces the traditional malicious hyperlink or file attachment. Many phishing kits now include dedicated QR-code generators, allowing rapid campaign creation.
2. Filter bypass — concealment. The malicious destination URL is encoded in a two-dimensional visual barcode, not rendered as readable text. Traditional email security filters that rely on URL extraction and inspection cannot parse the encoded destination. Some campaigns further obfuscate the QR code by embedding it inside PDF or JPEG attachments, adding a second layer that text-based filters cannot penetrate.
3. Social engineering — trusted branding and urgency. Emails leverage recognised brands (e.g., DocuSign, Microsoft) and create urgency through pretexts such as "secure your account" or "authenticate to confirm your details." Because the QR code itself contains minimal text, victims cannot spot typos or grammatical errors typical of traditional phishing.
4. Environment transition — corporate to personal device. The victim scans the QR code with a personal mobile phone, moving the interaction from a managed corporate endpoint with business-grade security controls to a potentially unmanaged device with fewer protections.
5. Payload execution — credential theft, MFA harvest, or malware install. On the mobile device, the victim is directed to a credential-harvesting phishing page, an MFA token interception page, or a direct app download bypassing app store security (malware disguised as a legitimate app). In some variants, the QR code links directly to a legitimate social media, payment, or other app for account takeover scenarios.

Technical specifics from source

• QR code encoding: QR (Quick Response) codes are two-dimensional barcodes capable of encoding URLs, payment details, contact information, and other data.
• Attachment formats observed: PDF and JPEG files containing embedded QR codes.
• Detection naming: ESET tracks quishing emails under the detection name QRCode/Phishing, processed through a dedicated layer of the ESET email scanner that identifies QR codes across file types, decodes embedded URLs, and passes them to anti-phishing, anti-malware, and anti-spam engines.
• Prevalence: 11% of all phishing email in H1 2026 contained malicious QR codes (ESET Threat Report H1 2026 — single-sourced; vendor telemetry).

Confidence caveat: The 11% prevalence figure and the ESET detection methodology are single-sourced from ESET's own telemetry. No independent corroboration is available in the provided source material. No specific threat actor, CVE, malware family, C2 infrastructure, file hashes, domains, or IP addresses are identified in the source. Attribution is unconfirmed — no MITRE actor profile is referenced.

4. Mitigation & containment

P1 — Within 24 hours

• Email gateway configuration: Ensure email security solutions can decode QR codes from image attachments (PDF, JPEG, PNG) and extract embedded URLs for inspection. If using ESET, confirm the QRCode/Phishing detection layer is enabled. If using another vendor, verify equivalent OCR/barcode-decoding capability exists and is active.
• URL rewriting / time-of-click protection: Confirm that safe-links or URL-rewriting services cover URLs extracted from QR codes in attachments, not only inline hyperlinks.
• User advisory: Issue a targeted warning to staff about QR codes in email, specifically referencing the DocuSign and Microsoft brand-abuse pretexts and the "secure your account" / "authenticate" urgency lures.

P2 — Within 72 hours

• Mobile device posture review: Assess whether corporate MDM/UEM policies adequately cover the scenario where a user scans a QR code from a corporate email on a personal device. If BYOD is permitted, verify that mobile threat defence (MTD) is deployed on enrolled devices.
• MFA resilience: Review MFA implementation to ensure resistance to token harvesting — prefer phishing-resistant MFA (FIDO2/WebAuthn hardware keys) over push notifications or OTP codes that can be intercepted on a rogue page.
• Attachment filtering rules: Create or tune mail-flow rules that flag emails containing image-only attachments (PDF/JPEG) with minimal text body, particularly when sender domains are external or newly registered.

P3 — Within 7 days

• Security awareness training update: Incorporate quishing-specific scenarios into phishing simulation campaigns, including QR codes embedded in PDF attachments with trusted-brand lures.
• App installation controls: For managed mobile devices, enforce restrictions on sideloading and direct app downloads from non-store sources to mitigate the "malware disguised as legitimate app" vector.
• Detection content: Develop Sigma-style alerts for unusual patterns: corporate email containing image attachments with embedded QR codes from external senders; spikes in QR-code-bearing email from a single sender or domain.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material describes behavioural patterns and general techniques but does not provide specific strings, file names, registry keys, mutex names, command-line arguments, or other artefacts suitable for YARA or Sigma rule construction. The ESET detection name QRCode/Phishing is a vendor product signature, not a threat artefact, and cannot be used as a YARA string.

7. Sources

• WeLiveSecurity (ESET), "How QR-code phishing can slip past corporate security measures," https://www.welivesecurity.com/en/business-security/qr-code-phishing-slip-past-corporate-security-measures/, 2026-08-17

8. Adverse Trace position

Quishing represents a meaningful escalation in phishing tradecraft because it exploits a structural gap in email security — the inability of many filters to decode and inspect URLs embedded in visual barcodes — and shifts the attack surface to mobile devices where enterprise controls are weakest. The 11% prevalence figure (single-sourced to ESET H1 2026 telemetry) indicates this is no longer a niche technique. For EMEA financial services, the credential-theft and MFA-harvesting variants are the highest-impact scenarios, potentially enabling account compromise and fraudulent transactions. We assess this as a medium-severity persistent threat requiring defensive adjustments rather than emergency response. Adverse Trace will continue monitoring for specific quishing campaigns targeting financial services, associated IOCs, and any named actor attribution. Clients should prioritise P1 email-gateway verification and user advisory actions immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.