Quishing (QR phishing)

Quishing puts the malicious URL behind a QR code, often in an email attachment (PDF, image). The code is unreadable to most URL-filtering gateways, but a mobile camera will open it instantly.

Quishing has grown sharply since 2023 — it's effective specifically against companies whose security tooling inspects email links but not images.

If you must scan a code from an email or printout, use a QR app that previews the URL first, and apply the same suspicion you would to any other unknown link.