In short
In quishing, the malicious link sits inside a QR code, either in the email body or in a PDF attachment. Because the link is an image, many filters never read it, and because it gets scanned with a phone, the victim leaves the company's protected computer. It's stopped by reading QR codes in images and attachments and verifying their destination before delivering the email.
What quishing is
Quishing comes from "QR" and "phishing." The email asks you to scan a code to "reactivate two-factor verification," "sign a document," or "review a payment." The code leads to a fake login page.
Why it works
- The link isn't text. A filter that only checks written links sees nothing suspicious in an image.
- It opens on a phone, outside the company computer's protections, and on a small screen where it's hard to see the full address.
- It looks modern and official. QR codes are used for payments, menus and paperwork, so they don't raise suspicion.
Warning signs
- An email asking you to scan a QR code for something related to your email account, your password, or two-factor verification.
- A PDF attachment that contains only a QR code and a short line of text.
- Urgency: "your access will be deactivated today."
- On scanning, an address that doesn't match the company claiming to send it.
How to protect yourself
- Never log in to your work account from a QR code that arrived by email.
- Before opening the link, check the address preview your phone's camera shows.
- Explain to your team that no serious company asks to reactivate two-factor verification via a QR code in an email.
- Use a filter that reads QR codes. Clisec reads QR codes in images and attachments, and verifies their destination before delivering the email.
Frequently asked questions
Can a QR code infect my phone just by scanning it?
Scanning it only reveals an address. The risk is in opening it and typing data into the page, or downloading what it offers.
Does SpamAssassin detect quishing?
It doesn't read QR codes inside images or PDFs, so it generally can't evaluate their destination.
Protect every account on your server
Clisec reads QR codes in images and attachments and verifies their destination before delivering the email, across your whole cPanel server.