QR Code Phishing Attacks Steal Login Credentials

Key Takeaways

• Cybercriminals are increasingly embedding QR codes in phishing emails, a tactic dubbed “quishing,” to bypass traditional email security filters and steal login credentials.
• This method exploits user trust in QR codes as convenient shortcuts, often leading victims to fake login pages.
• ESET’s H1 2026 threat telemetry shows a significant surge in QR code phishing, with approximately 11% of all detected phishing emails utilizing this technique.
• The attacks often leverage social engineering themes like urgent payroll updates or benefits notices to pressure victims into scanning the codes quickly.
• Mitigation requires robust email security, mobile device protection, and comprehensive user education to identify and avoid suspicious QR codes.

The Rise of Quishing: QR Codes as Phishing Vectors

Cybersecurity experts are observing a concerning trend: attackers are increasingly embedding QR codes within phishing emails to compromise user credentials. This technique, known as “quishing,” leverages the visual nature of QR codes to bypass traditional text-based security defenses and trick recipients into scanning what appears to be a legitimate shortcut, only to be redirected to malicious websites designed to harvest sensitive information.

The efficacy of this tactic stems from a common user behavior. While individuals have grown wary of suspicious hyperlinks in emails, QR codes are often perceived as harmless, convenient tools. Attackers exploit this perception by crafting compelling email messages that demand immediate action, such as urgent notifications about payroll, employee benefits, or documents requiring review, thereby pressuring recipients to scan the embedded QR code without proper scrutiny.

Escalation in QR Code Phishing Detections

According to ESET’s H1 2026 threat report, QR code phishing has reached unprecedented levels. The security firm’s telemetry indicated a consistent increase in these attacks from the beginning of the year, peaking in April. The impact of such a breach can extend far beyond a single compromised password, potentially exposing corporate email accounts, cloud storage, payment details, and other confidential data, providing attackers with a critical foothold for further fraudulent activities or internal spear-phishing campaigns.

Anatomy of a QR Code Phishing Attack

A typical quishing attack often originates in a corporate email inbox. The deceptive email is meticulously crafted to mimic legitimate communications from trusted internal services, frequently personalized to enhance credibility. The language employed is designed to create a sense of urgency, compelling the recipient to act swiftly before verifying the request through alternative channels.

Instead of a conventional clickable link, the malicious message features a QR code, either directly embedded in the email body or attached as an image. Upon scanning this code with a mobile device, the victim is presented with a decoded URL that, when accessed, leads to a fraudulent sign-in page. This counterfeit page is engineered to capture login credentials or other sensitive personal and corporate data.

The visual format of QR codes presents a significant challenge to both human users and automated security systems that primarily focus on text-based analysis. Furthermore, advanced techniques, such as imageless QR code attacks, demonstrate that threat actors can construct scannable codes using email markup languages, thereby circumventing security solutions that specifically look for image objects.

The shift to mobile devices for interaction further benefits attackers. Personal or unmanaged phones often lack the comprehensive security protocols present on corporate computers, making it difficult for users to inspect the ultimate destination of a QR code as easily as they might hover over a traditional email link. ESET categorizes these threats as QRCode/Phishing, utilizing advanced scanning layers to detect and decode QR codes, analyze their URLs, and cross-reference destinations against anti-phishing, anti-malware, and anti-spam databases. This allows for the blocking, flagging, or deletion of harmful links.

In the first half of 2026, QR codes were present in approximately 11% of all phishing emails detected by ESET. The company reported around 100,000 such detections monthly, with the United States accounting for 19% of these incidents, Spain for 17%, and Mexico for 6%.

Why Familiar QR Codes Work

The ubiquity of QR codes across various daily activities—from restaurant menus and payment terminals to hotel check-ins and workplace processes—contributes significantly to their effectiveness in phishing schemes. This pervasive familiarity often leads users to scan codes impulsively, only considering the legitimacy of the destination after their browser has already initiated the connection.

Attack campaigns are also adept at exploiting human emotions and urgency. ESET has observed phishing emails masquerading as critical corporate HR communications, particularly those related to compensation and benefits. These topics are strategically chosen to provoke a rapid, unthinking response from recipients, causing them to overlook common warning signs of a scam.

The threat of malicious QR codes extends beyond email inboxes. Cybercriminals have been known to place fraudulent QR codes in physical locations, such as on parking meters, public bicycles, fake event tickets, and bogus toll notices. These codes redirect victims to imposter payment portals designed to steal credit card information. Users must treat all <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/ca1f6b3e-73fb-454e-b217-f938ffc001a9/Hackers-Use-QR-Codes-in-Phishing-Emails-to-Steal-Login-Credentials.pdf?AWSAccessKeyId=ASIA2F3EMEYE3CRKTEQJ&Signature=9KB5wmn27X5TnaYbY%2F5eJocC0Os%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBUaCXVzLWVhc3QtMSJGMEQCIG6EjFlc4877XzcJarAT4PfGaJPX9t4rVcPdHRG%2BDKpQAiB1MV7ICIRDkNKrDfHgpwnp%2F7m%2BSzsw056l%2FXjvt%2BQaTir8BAje%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAEaDDY5OTc1MzMwOTcwNSIMOkFBnnex96QdnebNKtAECBen7s1lZyscx3dBPysgD%2FfZhNw92fcSCOgVveKmlmWUf8AgAIpQmOcsD%2FsKg%2BzpmXmLc6XtGXRZSmuylSkSSgIyNJe%2FoeFkfKh6AEBhRADnW7Fz3qL0y%2BiI%2Fph0RiAbGE4nn8c%2FE6PAYg5QB3NU9fXGc70ArVuntaBkrvqukxXaFIuTQ2yFT9WGGx60AkKVU0y32CPASWLPqBj0IE8jnqY30oei8Q2TYyFlKoIn6oSa%2F2Lxy1MXwzPIzyKKw8Sdocv0gfYcgvfyb1t9daB9dwFxACIbKH8pGzfhtlCGpRwQJRKI%2FgZlxx5iE7ViPhcXl0IPLl4Q9cJYVnFGJqltgopfthuZGOr5Uu%2F%2BWkCXth0Su3PpAF4HA95c%2BL67%2FrqlHtQq8fJw8mcYfC51wz%2FghdxJ%2FM%2BJu06B2Urg2%2BoDn0XCPkbJU1Ryi6o%2FXdb0MhqDG5g9lq9kZ%2BaD81OY%2FkEMOmRBJvdSl3pPfwOraIgXki3ROIzBSVH8U0Qt%2B6ZjJ6pInHGrEyWrHrUUxwBcG40BIeEXCqgEEESK6FGw7%2FjBzSxaQq9%2Fv2OuO9qE1l5Xvoz1fG7O80IA2HAXE%2BCGaf

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.