QR code phishing (quishing) in the browser

How it usually happens in the browser

• The attacker places a QR code in an email, PDF, poster, package insert, or fake “security update” notice.
• The user scans it and lands on a shortened URL or a redirect chain that hides the final domain.
• The destination is often a fake login page or a payment capture form.
• Victims may complete the flow on mobile where security controls and URL visibility are weaker.

What traditional defenses miss

• Email gateways can’t always safely “detonate” a QR code without image analysis.
• Users treat QR codes as physical-world trusted objects (posters, lobbies, shipping labels).
• On mobile, full domains are truncated and security cues are subtle.

How isolation changes the game

• Isolation helps by making untrusted browsing disposable and policy-controlled when QR links are opened in managed browsers.
• When sessions are isolated and deleted, risky link explorations don’t leave long-lived browser artifacts behind.
• Admins can enforce stricter policies for URL shorteners and newly registered domains where QR codes often point.

Operational checklist

• Block or warn on URL shorteners and unknown redirectors; force them into isolation.
• Use device management to ensure work browsing stays within managed browsers on mobile.
• Create a safe internal workflow: “verify QR destination” for HR/IT notices and physical signage.
• Require step-up auth on sensitive actions if the user arrived via an external link.
• Run periodic quishing simulations and measure click-to-credential-entry rate (not just click rate).

FAQs.