Phoenix 24
A familiar square has become a gateway to invisible fraud.
Global
QR code phishing is emerging as one of the fastest growing cyber threats of 2026, with Microsoft reporting a 146 percent increase in attacks during the first quarter of the year. The volume climbed from 7.6 million incidents in January to 18.7 million in March, the highest monthly level recorded in at least a year. The technique, commonly known as quishing, exploits the routine use of QR codes in restaurants, parking systems, tourism, payments and workplace communications. Its strength lies in simplicity: users often scan first and question later.
The attack works by hiding a malicious destination behind a visual code. Unlike a conventional hyperlink, a QR code does not immediately reveal where it will send the user, making fraudulent pages harder to identify before interaction begins. Victims can be redirected to websites that imitate banks, corporate portals or authentication services. Once there, attackers attempt to steal passwords, personal information, financial data or money.
Microsoft’s threat intelligence data also show why the tactic is difficult to control. During the first quarter of 2026, the company detected approximately 8.3 billion email based phishing threats overall, while QR based attacks became the fastest growing vector. PDF attachments were the dominant delivery method, accounting for roughly 70 percent of QR phishing attempts by March. Codes embedded directly inside email messages also increased sharply during the same period.
Mobile behavior creates another vulnerability. Employees frequently scan suspicious QR codes with personal smartphones, moving the interaction away from corporate computers and potentially outside the organization’s principal security controls. That shift allows attackers to exploit the gap between protected workplace infrastructure and less controlled personal devices. The attack therefore succeeds not only because of technology, but because it crosses security boundaries that users rarely notice.
The trend changed during the second quarter, when QR phishing volumes declined from the March peak. Yet that reduction does not eliminate the underlying risk. Attackers continue rotating delivery methods between PDF files, office documents and other formats, demonstrating how quickly cybercrime adapts when one technique becomes easier to detect.
The broader lesson is increasingly clear. QR codes were designed to remove friction from digital interaction, but that convenience also removes moments of hesitation that once helped users recognize suspicious behavior. In cybersecurity, the most dangerous interface may be the one people trust without thinking.
Lo visible y lo oculto, en contexto. / The visible and the hidden, in context.