QR codes have become a common part of everyday business, appearing on invoices, benefits forms, account setup instructions, and event registrations. Attackers are taking advantage of that familiarity to trick employees into visiting malicious websites.
QR code phishing, also known as quishing, has seen a resurgence. According to Microsoft, attacks increased 146% between January and March 2026, reaching 18.7 million in March.
For MSPs and IT teams, this creates another way for attackers to steal business credentials, even when employees are accustomed to recognizing suspicious links.
What Is QR Code Phishing?
QR code phishing uses a scannable code to direct someone to a malicious website instead of including a traditional clickable link.
Attackers often embed these codes in emails or attachments that appear to come from legitimate organizations. Scanning the code can lead to a fake Microsoft 365 sign-in page or another website designed to steal credentials.
Unlike a standard hyperlink, employees cannot hover over a QR code to preview its destination. Scanning may also move the interaction from a company-managed computer to a personal phone that lacks comprehensive security protection.
How a QR Code Phishing Attack Works
Here’s an example of a QR code phishing attack. An employee receives an email containing a PDF that appears to require their signature. The document includes a QR code with instructions to scan it to complete the process.
The employee scans the code using their phone and is directed to a website that looks like a legitimate Microsoft 365 login page.
Believing they need to sign in to access the document, they enter their credentials. Those credentials are then captured by the attacker, potentially giving them access to the employee’s account.
Because the malicious URL is encoded in an image, security systems that only inspect visible links may not identify the threat.
Why QR Code Phishing Is Resurging
QR code phishing isn’t new, but attackers are adapting how they deliver these attacks.
Microsoft recorded 7.6 million QR code phishing attacks in January 2026, rising to 18.7 million in March. Although volumes declined after that peak, attackers continued changing their techniques.
One notable shift is the increasing use of document attachments. By June, Word documents accounted for 40% of QR code phishing payloads, compared with 24% in March.
This shift makes detection more complicated. Instead of placing suspicious links directly in an email, attackers can conceal them within documents that appear to contain routine business information.
A Real-World QR Code Phishing Campaign
A Microsoft investigation shows how attackers are putting this approach into practice.
In February 2025, attackers targeted more than 2,300 organizations with tax-themed phishing emails. Many of the messages contained little or no text and included PDF attachments that appeared to require a signature.
Inside the documents were QR codes directing recipients to infrastructure associated with RaccoonO365, a phishing-as-a-service operation designed to steal Microsoft 365 credentials.
The campaign illustrates how attackers can use familiar business processes, such as reviewing and signing documents, to encourage employees to scan a malicious code.
How MSPs and IT Teams Can Protect Against QR Code Phishing
Protecting against these attacks requires security that can evaluate more than the visible content of an email.
Detect threats before employees engage.
Trustifi Inbound Shield combines threat intelligence, behavioral analysis, sender and domain signals, and content inspection to identify sophisticated phishing attempts.
For supported QR code threats, Inbound Shield decodes the embedded URL and analyzes its destination in a sandbox. This helps identify credential-harvesting pages and brand impersonation attempts before employees have a chance to interact with them.
Trustifi proactively detects and quarantines malicious QR code phishing emails before they reach employees, preventing users from interacting with dangerous links and fraudulent login pages.
Help employees recognize suspicious requests.
Employees should be cautious of unexpected QR codes requesting logins, MFA resets, or payment information. Encourage them to access company services directly through trusted websites rather than scanning unfamiliar codes.
Trustifi Security Awareness Training can also turn real detected threats into phishing simulations, helping employees recognize the techniques attackers are using.
Maintain consistent protection across clients.
For MSPs, managing these threats across multiple customer environments adds another layer of complexity. Trustifi’s centralized multi-tenant management helps MSPs standardize protection and training without managing separate security solutions for each client.
See What Your Email Security May Be Missing
As phishing techniques evolve, MSPs and IT teams need to understand where their existing defenses may have gaps.
Trustifi works alongside Microsoft 365 and Google Workspace to provide additional protection against sophisticated inbound threats, helping organizations strengthen email security without adding unnecessary complexity.
Request a Demo
