.png)
What is quishing?
Quishing is phishing that uses a QR code instead of a hyperlink to deliver the malicious URL. The attacker embeds a QR code image in an email body or attachment. The recipient scans it with their phone, which opens the attacker's credential-harvesting page in the phone's browser — outside the corporate network, outside Defender for Endpoint, and outside any endpoint security tool running on the work laptop.
The attack exploded in 2024 because it solves the attacker's biggest problem: email security gateways scan URLs in email text and rewrite them with Safe Links. A QR code is an image. There is no URL for the scanner to find. Microsoft Defender's Safe Links, Proofpoint, and Mimecast all miss QR code URLs unless they have dedicated QR decoding capability explicitly enabled.
Figure 1 — Quishing attack flow. The QR code bypasses URL scanning; the phone scan bypasses endpoint security; the AiTM proxy bypasses standard MFA. All three defense layers must be active.
Why standard MFA does not stop quishing
Most quishing attacks use an Adversary-in-the-Middle (AiTM) proxy — a server that sits between the victim and the real Microsoft login page, relaying credentials and MFA codes in real time. The victim completes their MFA prompt, the attacker captures the authenticated session token, and the MFA event is logged as successful. From Microsoft's perspective, the login looks legitimate.
This means SMS MFA, authenticator app TOTP codes, and push notifications are all bypassable via AiTM. The only MFA methods that are phishing-resistant are:
- FIDO2 security keys (YubiKey, etc.) — the key cryptographically binds to the legitimate domain; an AiTM proxy on a different domain cannot complete the challenge.
- Windows Hello for Business — device-bound credential, not transferable.
- Microsoft Authenticator with number matching + additional context — not fully phishing-resistant but significantly harder to abuse than push-only.
- Certificate-based authentication (CBA) — device certificate required, not stealable via AiTM.
Common quishing lures
| Lure | Pretext | Target |
|---|---|---|
| Microsoft MFA re-enrollment | "Your authenticator app needs to be updated — scan to re-enroll" | M365 credentials + session token |
| Shared document notification | "Scan to view the document shared with you in SharePoint" | M365 credentials |
| HR / payroll portal | "Scan to update your direct deposit information" | Payroll redirect / identity theft |
| Physical QR codes | Stickers placed over legitimate QR codes in public spaces | Any credential or payment info |
| Parking / EV charging | Fake payment QR codes on parking meters or charging stations | Payment card data |
Detection and defense
Email layer
- Microsoft Defender for Office 365 QR code scanning: Defender Plan 1 and Plan 2 now include QR code URL extraction from images. This must be verified as active — it is not enabled by default on all tenants. IDENETY enables and validates this as part of the M365 Security Baseline.
- Anti-phishing policy tuning: Enable first-contact safety tips and unusual character warnings that flag emails with embedded images from external senders.
Identity layer
- Deploy phishing-resistant MFA: Migrate high-value accounts (executives, finance, IT admins) to FIDO2 keys or Windows Hello for Business. This is the only control that defeats AiTM session token theft.
- Conditional Access — compliant device requirement: Require that M365 access comes only from Intune-managed, compliant devices. A phone that scanned a QR code and opened a browser is not a managed device and will be blocked.
- Token lifetime policies: Reduce session token lifetime for high-risk roles so stolen tokens expire quickly.
User awareness
Train staff on these specific quishing red flags:
- Any email asking you to scan a QR code to log in, re-enroll MFA, or access a document.
- QR codes in emails from external senders — legitimate internal systems rarely require QR scanning.
- Urgency combined with a QR code ("Your account will be locked — scan now").
- Physical QR codes that look like stickers placed over existing signage.
See our Spam Filter vs. Email Security Gateway article for the full Defender for Office 365 configuration context, and our Wire Fraud & BEC Prevention guide for the account takeover scenarios that follow a successful quishing attack.
Contact our engineers to enable QR code scanning in your Defender tenant and assess your phishing-resistant MFA readiness.
