ESET warns of rising ‘quishing’ attacks using malicious QR codes

Cybercriminals are increasingly utilizing a technique known as ‘quishing’—phishing via QR codes—to compromise corporate credentials. According to the ESET Threat Report H1 2026, malicious QR codes accounted for 11% of detected phishing emails.

This method exploits user complacency by replacing traditional malicious links with two-dimensional visual patterns. Because these codes are often embedded in PDF files or JPEG images, they can bypass standard corporate email filters that are unable to decode the threat.

Security researcher Mario Micucci of ESET warns that scanning a code can shift the interaction from a protected corporate computer to a personal mobile device, effectively evading enterprise security controls. To mitigate these risks, experts recommend a combination of continuous employee training, mobile device security solutions, and phishing-resistant multi-factor authentication.