Quishing: The Rising Threat of QR Code Phishing in 2026

Quishing, a new form of phishing using QR codes, has rapidly gained traction in 2026, exploiting user familiarity with QR technology. Attackers embed malicious URLs within QR codes, redirecting victims to fraudulent websites designed to steal sensitive information. This method bypasses traditional email security filters, as QR codes are treated as images rather than links. In the first half of 2026, malicious QR codes were found in 11% of all phishing emails. The ESET Threat Report indicates that organizations are increasingly vulnerable as these attacks direct users from secure corporate environments to less protected personal devices. Security experts warn that quishing can lead to credential theft, financial fraud, and even malware installation. Users are urged to exercise caution when scanning QR codes, especially those embedded in unsolicited communications.

Key Points: • Quishing attacks exploit QR codes to conceal malicious URLs, making detection difficult. • 11% of phishing emails in early 2026 contained malicious QR codes, highlighting the growing threat. • Attackers leverage social engineering tactics, often using trusted brands to deceive victims.