Category: Phishing & Social Engineering
QR code phishing (quishing) in the browser
QR code phishing (“quishing”) uses a QR code to hide a malicious URL that opens a browser link on a phone or workstation.
Quick answer
QR codes bypass many traditional link previews and filters, pushing users straight into a browser flow where they’re less likely to inspect the destination.
For risky links and login flows, isolation keeps the page off the endpoint by running it in a disposable container and streaming only the rendered output to the user.
When you need this
- You’ve seen indicators of this threat in your environment.
- Users frequently click unknown links as part of daily work.
- You need a control that reduces risk without relying on perfect user judgment.
Last updated
2026-01-29
How it usually happens in the browser
- The attacker places a QR code in an email, PDF, poster, package insert, or fake “security update” notice.
- The user scans it and lands on a shortened URL or a redirect chain that hides the final domain.
- The destination is often a fake login page or a payment capture form.
- Victims may complete the flow on mobile where security controls and URL visibility are weaker.
What traditional defenses miss
- Email gateways can’t always safely “detonate” a QR code without image analysis.
- Users treat QR codes as physical-world trusted objects (posters, lobbies, shipping labels).
- On mobile, full domains are truncated and security cues are subtle.
How isolation changes the game
- Isolation helps by making untrusted browsing disposable and policy-controlled when QR links are opened in managed browsers.
- When sessions are isolated and deleted, risky link explorations don’t leave long-lived browser artifacts behind.
- Admins can enforce stricter policies for URL shorteners and newly registered domains where QR codes often point.
Operational checklist
- Block or warn on URL shorteners and unknown redirectors; force them into isolation.
- Use device management to ensure work browsing stays within managed browsers on mobile.
- Create a safe internal workflow: “verify QR destination” for HR/IT notices and physical signage.
- Require step-up auth on sensitive actions if the user arrived via an external link.
- Run periodic quishing simulations and measure click-to-credential-entry rate (not just click rate).
FAQs.
References.
- 01
- 02Cloudflare: Browser IsolationCloudflare
