Security advice for enterprise employees has focused on a simple rule for decades: don’t click suspicious links in emails. Security teams hardened defenses accordingly—deploying secure email gateways (SEGs), automated URL sandboxing, and link-rewriting engines.
Attackers have adapted by changing the delivery format. Instead of sending a clickable text link, they encode the destination into an image grid—a QR code.
ESET’s H1 2026 Threat Report highlights a massive spike in this tactic, logging an average of 100,000 QR-phishing (quishing) email detections every month (peaking in April) — about 11% of all detected phishing emails now carry a QR code. Microsoft separately reported a 146% quarterly surge in QR code phishing.
The vector isn’t just growing; it represents an intentional exploit of the air gap between desktop security and unmonitored mobile endpoints.
How the Bypass Works
In a typical corporate setup, email security systems parse incoming text strings. If an email contains a link to malicious-phishing-site.com, security gateways flag the domain, sandbox the endpoint, or rewrite the link to pass through an inspection proxy. QR codes bypass this layer entirely:
- The static image shell. The attacker embeds the malicious URL inside a standard PNG or JPEG matrix. Traditional text-based email scanners see the body as benign, unclickable image data.
- Social-engineering the handoff. The email impersonates routine corporate operations—DocuSign agreements, payroll updates, HR benefits reviews—and prompts the employee to “Scan to view document” using their mobile phone.
- Pivoting off the protected endpoint. Scanning shifts the execution context entirely. The user leaves their protected corporate desktop (EDR, DNS filtering, monitored browser sessions) and moves to an unmanaged personal mobile device.
“The malicious link is encoded in an image, making it invisible to traditional email security controls – and equally opaque to the human eye… it moves the victim from a relatively well-protected corporate environment to a potentially unmanaged mobile device, effectively bypassing multiple layers of enterprise security in a single step.”— Dariusz Iwański, ESET Senior Detection Engineer
The Mobile Camera Blindspot
Once the user points their phone at the desktop screen, the native camera app takes over. Mobile camera parsers are optimized for speed, not input safety: they parse the raw QR string, generate a floating preview banner, and wait for a single tap to launch the default browser — which most users are quick to give.
- No redirect unrolling. Native camera apps do not expand short URLs (bit.ly, t.co) or trace multi-hop HTTP redirect chains before presenting the preview.
- No SSL/TLS validation. The native preview doesn’t check whether the underlying endpoint holds a valid certificate or relies on a freshly registered domain.
- No reputation checking. The mobile OS hands the payload straight to the browser without checking the host against known threat feeds.
The attacker successfully forces an unmonitored mobile browser to open an uninspected link—bypassing every enterprise security control built over the last twenty years.
Pre-Screening Should Be the Default
Relying on employees to visually inspect a tiny preview banner while holding a phone up to a monitor is an operational failure. The human eye cannot decode a QR matrix or detect a redirect chain hidden behind a short link. Defending the mobile endpoint requires programmatic pre-screen inspection before browser handoff:
- Local payload parsing. Decode the raw string on-device to classify the payload type (URL, vCard, Wi-Fi configuration, custom app intent).
- Anonymous redirect expansion. Unroll shortened URLs and trace HTTP redirect hops through a proxy layer, so the host identity is fully unmasked before connection.
- Threat scoring. Evaluate host reputation, domain age, and certificate validity, and present a clear risk badge (SAFE, CONFIRM, or DANGER) before the OS acts on the instruction.
The Trajectory: Worse Before It Gets Better
Like other structural security gaps, quishing will escalate before defensive models catch up. Threat actors know mobile endpoints are the current path of least resistance, and the telemetry shows rapid geographic and tactical expansion.
ESET’s H1 2026 data shows heavy concentration across the United States (19% of detections), Spain (17%), and Mexico (6%), alongside the UK (5%) and Czechia, Canada, Poland, and Italy (3% each). The vector has also reached nation-state maturity: the FBI has warned that the North Korea–aligned APT group Kimsuky is actively deploying malicious QR codes in spearphishing campaigns against U.S. entities — noting the compromise path “originates on unmanaged mobile devices outside normal EDR and network inspection boundaries.”
At the consumer level, attackers adapt just as fast. Campaigns documented by BleepingComputer show scammers abandoning raw SMS text links — which carriers now filter effectively — in favor of texts carrying an image with an embedded QR code, impersonating state-court traffic violations. To evade automated crawlers, the QR routes through an intermediary CAPTCHA challenge before dropping victims onto a fake DMV payment portal.
Whether it arrives as an enterprise payroll email or a fake court-notice text, the core exploit is identical: bypass desktop and carrier filters by encoding the instruction into an unreadable image matrix, forcing unmonitored execution onto a mobile phone. As enterprise gateways and carrier filters harden, attackers will keep funneling execution onto unmanaged mobile screens.
Canary was built for this exact inflection point — giving mobile users an on-device, privacy-first pre-screen right as the payload blindspot peaks.
Sources: ESET Threat Report H1 2026 · Microsoft: Email threat landscape, Q1 2026 · FBI/IC3: Kimsuky malicious-QR spearphishing alert · BleepingComputer: traffic-violation QR texts.