Listen to the episode
TLDR
Quishing , or QR code phishing, has surged as attackers exploit the fact that QR codes move victims from a protected corporate computer onto a personal phone with weaker security controls. A malicious code embedded in an email or PDF hides...
How it works
Quishing , or QR code phishing, has surged as attackers exploit the fact that QR codes move victims from a protected corporate computer onto a personal phone with weaker security controls. A malicious code embedded in an email or PDF hides...
Red flags
- An unsolicited email containing a QR code, especially branded as DocuSign, Microsoft 365 or a bank. Urgency cues such as "verify now", "confirm your credentials", or threats of account suspension. Codes embedded inside image or PDF attachments, which evade most email link scanners
What to do
- 1Do not scan QR codes from unexpected or unsolicited emails
- 2confirm requests through a separate, trusted channel first. Install and keep updated an anti phishing / mobile security app on every personal device used for work. Report any suspicious quishing messages immediately to your IT or security team so
Source
welivesecurity
Source reviewed by Mythos Forensic Team
https://www.welivesecurity.com/en/business-security/qr-code-phishing-slip-past-corporate-security-measures/FAQ
Is Quishing: how QR code phishing slips past corporate security and what to do about it a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
An unsolicited email containing a QR code, especially branded as DocuSign, Microsoft 365 or a bank. Urgency cues such as "verify now", "confirm your credentials", or threats of account suspension. Codes embedded inside image or PDF attachments, which evade most email link scanners
What should I do first?
Do not scan QR codes from unexpected or unsolicited emails; confirm requests through a separate, trusted channel first. Install and keep updated an anti phishing / mobile security app on every personal device used for work. Report any suspicious quishing messages immediately to your IT or security team so
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.