| name | detecting-qr-code-phishing-with-email-security |
| description | Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails. |
| domain | cybersecurity |
| subdomain | phishing-defense |
| tags | ["quishing","qr-code","phishing","email-security","image-analysis","ocr","mobile-security"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| atlas_techniques | ["AML.T0052","AML.T0024","AML.T0035"] |
| nist_ai_rmf | ["MEASURE-2.8","MAP-5.1"] |
| nist_csf | ["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"] |
Detecting QR Code Phishing with Email Security
Overview
QR code phishing (quishing) is a rapidly growing attack vector where malicious URLs are embedded in QR code images within phishing emails. Quishing incidents grew fivefold from 46,000 to 250,000 between August and November 2025, with credential phishing comprising 89.3% of detected incidents. Traditional email security filters struggle because QR codes cannot be read by humans or standard URL scanners, and when scanned, users typically use personal mobile devices that lack corporate security controls. Attackers have evolved to use split QR codes (two separate images), nested QR codes, and ASCII text-based QR codes to evade detection.
When to Use
- When investigating security incidents that require detecting qr code phishing with email security
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Detection Gaps & Validation
- Link scanners are blind to images: the malicious URL lives inside a QR PNG/JPG/SVG, so text-based URL reputation and Safe Links never see it - the gateway must OCR/decode the image and submit the extracted URL to the same URL pipeline.
- Split and nested QR codes: Gabagool-style kits divide the code across two benign-looking images, or nest a QR-in-QR; single-image decoders miss these - require reassembly/multi-image analysis.
- ASCII / text-rendered QR: codes drawn with text characters bypass image analysis entirely (~12% of attacks) - add detection for QR-shaped character blocks.
- QR inside PDF/attachment: the code sits in a PDF or document, not the body - enable attachment QR scanning, not just inline image scanning.
- Detection shifts to the phone: even when decoded, the scan happens on an unmanaged personal device with no corporate proxy - pair gateway decoding with MTD/MDM warning on the destination.
- Validate detection: send test quishing (inline PNG, SVG, split-image, PDF-embedded, and ASCII variants), confirm each URL is decoded and sandboxed, and tune FPs - legitimate marketing/event QR codes and MFA-setup codes are the main false positives, so allowlist known-good senders rather than blocking all QR mail.
Prerequisites
- Email security gateway with image analysis capabilities
- Understanding of QR code structure and encoding
- Mobile device management (MDM) or mobile threat defense solution
- Security awareness training program
- SIEM platform for correlation and alerting
