QR Code Scams Explode: Are Your Security Tools Ready?

Cybersecurity threats are evolving rapidly, with Microsoft reporting an alarming 146% increase in QR code phishing, commonly known as 'quishing,' during the first quarter of 2026. This trend indicates a significant shift in attacker methodologies as they seek to circumvent increasingly sophisticated security defenses. Analysis of over 8.3 billion email-based phishing threats revealed that while overall volumes fluctuated, the nature of attacks changed notably.

Traditional security tools, designed to scan for text-based threats, are finding it challenging to identify embedded QR codes. A key vulnerability is that these attacks often direct victims to scan the code using mobile devices. This action moves the user outside the protected workstation environment and bypasses enterprise security, especially when personal devices are involved.

Attackers are also changing their delivery methods for quishing. While PDF attachments were a preferred method earlier in the quarter, a substantial 336% surge in March saw QR codes delivered directly within email bodies. Furthermore, Microsoft observed a dramatic increase in CAPTCHA-based attacks, exploding by over 125% in March after initial dips. These CAPTCHA pages trick users into believing they are completing a security verification, while instead executing malicious commands or delivering payloads.

Even the disruption of the Tycoon2FA phishing-as-a-service group by Microsoft and Europol in March had a limited impact, with the group quickly re-establishing its infrastructure using .RU domains. Business email compromise (BEC) also saw 10.7 million detected threats, with attackers favoring lure-based emails and leveraging payroll update requests during tax season, a vector that grew by 15% in February. Microsoft recommends enhanced security settings, employee training, and phishing-resistant multi-factor authentication to combat these evolving threats.