Quishing rises to 11% of phishing emails in H1 2026, evading email filters; Kimsuky uses QR codes against US targets
ESET warns that QR-code phishing ("quishing") is a growing way to slip past corporate email security. According to the ESET Threat Report H1 2026, malicious QR codes were embedded in 11% of all phishing emails in the first half of 2026. The codes hide destination URLs from filters that cannot extract and inspect them, and they move the victim from a managed corporate endpoint to a personal mobile device with fewer controls. A January 2026 FBI notice reportedly warned that the North Korean Kimsuky group used QR codes in spearphishing emails against think tanks, academic institutions and US/foreign government entities.
Technical Details
- The destination is encoded in a visual pattern rather than readable text, so some traditional email filters cannot extract and inspect it. QR codes are sometimes also embedded in PDF or JPEG attachments for further obfuscation.
- Emails contain little text to analyze for typos or grammar errors. Lures use trusted brands (e.g. DocuSign, Microsoft) and urgency, such as prompts to secure an account or re-authenticate.
- Many phishing kits include a dedicated QR-code generator.
- Reported uses include malware delivery, credential theft and MFA token harvesting. Other uses are direct app downloads that bypass app store security, links to legitimate apps for account takeover or payment fraud with pre-filled payees, contact/calendar poisoning, rogue Wi-Fi access points, and QR code shorteners to obfuscate malicious addresses.
- Kimsuky lures claimed the code led to questionnaires, registration landing pages or secure drives.
- ESET detects these emails as QRCode/Phishing. A dedicated email scanner layer decodes the URLs in the codes and scans them with anti-phishing, anti-malware and anti-spam engines.
Remediation
- Include quishing in awareness training and simulations. Tell staff not to scan QR codes in unsolicited emails and to verify with the sender using separately sourced contact details.
- Deploy email security capable of decoding QR codes, plus mobile security and MDM on employee devices.
- Require phishing-resistant MFA on sensitive accounts, enforce least privilege and just-in-time access, and keep mobile operating systems and corporate software up to date.
- Monitor continuously for suspicious activity and rehearse incident response plans.
Linha do tempo
-
Quishing rises to 11% of phishing emails in H1 2026, evading email filters; Kimsuky uses QR codes against US targets
ler a análise desta fonte ocultar
ESET warns that QR-code phishing ("quishing") is a growing way to slip past corporate email security. According to the ESET Threat Report H1 2026, malicious QR codes were embedded in 11% of all phishing emails in the first half of 2026. The codes hide destination URLs from filters that cannot extract and inspect them, and they move the victim from a managed corporate endpoint to a personal mobile device with fewer controls. A January 2026 FBI notice reportedly warned that the North Korean Kimsuky group used QR codes in spearphishing emails against think tanks, academic institutions and US/foreign government entities.
Technical Details
- The destination is encoded in a visual pattern rather than readable text, so some traditional email filters cannot extract and inspect it. QR codes are sometimes also embedded in PDF or JPEG attachments for further obfuscation.
- Emails contain little text to analyze for typos or grammar errors. Lures use trusted brands (e.g. DocuSign, Microsoft) and urgency, such as prompts to secure an account or re-authenticate.
- Many phishing kits include a dedicated QR-code generator.
- Reported uses include malware delivery, credential theft and MFA token harvesting. Other uses are direct app downloads that bypass app store security, links to legitimate apps for account takeover or payment fraud with pre-filled payees, contact/calendar poisoning, rogue Wi-Fi access points, and QR code shorteners to obfuscate malicious addresses.
- Kimsuky lures claimed the code led to questionnaires, registration landing pages or secure drives.
- ESET detects these emails as QRCode/Phishing. A dedicated email scanner layer decodes the URLs in the codes and scans them with anti-phishing, anti-malware and anti-spam engines.
Remediation
- Include quishing in awareness training and simulations. Tell staff not to scan QR codes in unsolicited emails and to verify with the sender using separately sourced contact details.
- Deploy email security capable of decoding QR codes, plus mobile security and MDM on employee devices.
- Require phishing-resistant MFA on sensitive accounts, enforce least privilege and just-in-time access, and keep mobile operating systems and corporate software up to date.
- Monitor continuously for suspicious activity and rehearse incident response plans.