Could a QR Code in an Email Lead Employees to a Fake Sign-In Page?

This technique is actively being used. In its incident response trends for the second quarter of 2026, Cisco Talos reported that attackers placed QR codes inside PDF attachments to slip past email filters, then used the codes to send people to pages built to harvest Microsoft 365 credentials. Phishing was the most common way in during that quarter. QR codes were one of the delivery methods that helped it work.

Why Does QR Code Phishing Matter for Your Inbox?

• A QR code hides its destination, so scanning is a decision to trust a link you cannot read.
• Codes tucked into a PDF or image can slip past email filters that only scan text.
• The goal is often a fake Microsoft 365 sign-in page built to capture a username and password.
• Scanning often moves the interaction to a phone, which may have different security controls than the workstation and email gateway.
• Awareness is one layer. It works best alongside a clear way to report and strong account protections.

What Is QR Code Phishing?

QR code phishing, sometimes called quishing, uses a scannable code in place of a visible link. The message might look like a shared document, a voicemail notice, or a request to confirm an account. Instead of a link you could hover over and inspect, it shows a code. When someone scans it, they land on a page the attacker controls, often one made to look like a familiar login. The code is simply a way to carry a link whose destination is not shown as plainly as a written URL. Depending on the scanner, a preview of the address may appear after scanning but before the page opens. In a QR code phishing attempt, that harder-to-check destination is the whole point, because it weakens the quick habit most people rely on to judge whether a link looks right.

Why Can QR Code Phishing Slip Past Email Filters?

Many email protections work by reading the text and links in a message. A QR code is an image, so a filter that only parses text may not see a link at all. Placing the code inside a PDF adds another layer between the filter and the destination. That is part of why Talos saw this method used. It is not that the defenses failed; it is that a picture of a link is harder to inspect than a written one. This is one reason awareness matters even when good email security is in place. QR code phishing works in the gap between a filter that cannot read the image and a person who cannot read the code.

What Does QR Code Phishing Look Like in Practice?

A typical attempt arrives as an ordinary-looking email, sometimes with a PDF that carries a company logo. It asks the reader to scan a code to view a file, keep an account active, or complete a routine task. Scanning opens a fake sign-in page on the person’s phone. If they enter their work username and password, the attacker now has those credentials, and depending on the account’s other protections may be able to use them to get in. In the campaign Talos observed, intruders who gained access added hidden inbox rules and sent more phishing from the account. You do not need to study the mechanics. You only need to recognize the shape: an unexpected code, a sense of routine or mild urgency, and a login prompt at the end.

How Can Your Team Respond to QR Code Phishing?

A few simple habits, backed by account protections, can support a more consistent response to these attempts.

• Treat an unexpected QR code the way you would an unexpected link, with a pause rather than a scan.
• To reach a real account, open the service yourself from a saved bookmark or the known web address.
• Never enter your work password on a page you reached by scanning a code in a message.
• Report anything that feels off through your established channel, so others can be warned.
• Support awareness with account protections, so a stolen password is not the whole story on its own.

That last point matters. Stronger sign-in methods reduce what a single stolen password is worth, which is part of why Microsoft is moving toward passkeys. Awareness and account protection work together, not in place of each other.

Not Sure a Message Is Genuine? Slow Down

If you cannot tell whether a message is genuine, that is a reason to slow down, not to guess. An unsure answer is not a failure. It is the moment the reporting path is meant for. Forwarding a questionable message to whoever handles that in your business is always a reasonable step, even if it turns out to be legitimate. It is far cheaper than entering a password on the wrong page.

Frequently Asked Questions

Are all QR codes dangerous?

No. Most QR codes are ordinary and harmless. The concern is that a code does not show its destination as plainly as a written link; depending on your scanner, a preview may appear after scanning. The caution applies to unexpected codes in emails, attachments, or messages, not to every code you encounter.

Why would an attacker use a code instead of a link?

A code is an image, so email filters that scan text may not see the link inside it. Scanning also moves the person to a phone, which may have different security controls than the workstation and email gateway. Both factors make a code an appealing way to deliver a fake sign-in page.

Someone on our team scanned a code and entered a password. Now what?

Treat it as time-sensitive and involve whoever manages your IT. Changing the password is a start, but a full response may also check for new inbox rules, unexpected sign-ins, and other changes to the account. Acting quickly limits what a stolen password can be used for.

Can email security stop these on its own?

Good email security helps, and it continues to improve at spotting codes in attachments. Even so, no single control catches everything, which is why awareness, a reporting path, and account protections work together. The combination is stronger than any one part alone.

Want Help Protecting Your Team From Phishing?

Awareness, a clear reporting path, and strong account protections can help reduce the risk from QR code phishing. Businesses in Venice, Sarasota, and North Port can ask NUPC Technology whether its managed IT services or cybersecurity services fit their situation. Request an IT consultation or call (941) 888-4474.