Quishing, phishing that hides a malicious link inside a QR code, is no longer a marginal threat. According to the ESET Threat Report H1 2026, QR codes appeared in around 11% of the phishing emails ESET analysed in the first half of 2026, and QRCode/Phishing ranked seventh among the main threats distributed by email during the period.
Where it hits most. The countries with the most detections of this technique were the United States (19%), Spain (17%) and Mexico (6%), according to ESET. In Latin America, the threat was among the most widespread phishing families, with Mexico leading regional detections.
The real trick. For ESET, the most relevant point is not the volume but the path the attack follows. By asking the victim to scan a code, the criminal moves the interaction from a relatively protected environment, such as a work computer with filters and antivirus, to a mobile phone that is often personal and not managed by the company. The report notes that attackers use QR codes to make quick inspection of malicious links harder.
Two real examples. ESET highlights two emails detected in the wild. One impersonates DocuSign, saying a document is ready to review and sign; its yellow button leads nowhere, so the only way forward is scanning the code. ESET says DocuSign was one of the brands most used by attackers in Latin American phishing campaigns in the half. The other email is almost a single line: "Please Scan QR to View New Salary", playing on curiosity.
Why it matters
Fewer clues, more trust. Unlike a written link, a QR code's destination is invisible until scanned. Quishing emails carry little text, leaving fewer spelling mistakes to spot, and mobile browsers often truncate or hide the address bar. Meanwhile, people scan QR codes daily for payments, promotions and logins, so they question them less. Once on the phone, victims may land on fake login pages, pre-filled payment screens or downloads of malicious apps from outside official stores. Physical codes are also used, including stickers placed over legitimate QR codes.
- Be wary of codes stuck over another code or showing signs of tampering.
- Distrust unsolicited codes and messages that push urgency.
- Check the URL your scanner shows before opening it.
- Go to official websites or apps manually for bills, deliveries or paperwork.
- Never install apps from unknown QR codes; use official stores only.
- Review every detail before confirming a payment or entering credentials.
The bigger picture. ESET concludes that quishing shows how criminals adapt known techniques to everyday digital habits: the more QR codes spread into daily life, the more opportunities they create for fraud.
Source: WeLiveSecurity (ESET, ES)
Leave a Reply