Phishing Goes Visual: Malicious QR Code Attacks Explode, Kaspersky Warns

Cybersecurity firm Kaspersky has flagged a sharp rise in phishing attacks that rely on malicious QR codes, warning that cybercriminals are increasingly turning to the tactic to bypass traditional email security filters. The company recorded a dramatic jump in detections—from 46,969 cases in August to 249,723 by November—marking a surge of more than five times in just three months.

According to Kaspersky, QR codes are becoming a preferred weapon for attackers because they are inexpensive to deploy and effective at hiding harmful links. Many email security tools struggle to analyse images, allowing QR-based threats to slip through undetected.

These QR codes are typically placed directly in email messages or hidden inside PDF attachments, a method that serves two purposes: disguising the malicious link and nudging recipients to scan it using smartphones. Mobile devices, especially personal ones used for work emails, often lack the same level of security controls as corporate desktops, making them an easier target.

The company observed that malicious QR codes are being used across both large-scale phishing campaigns and more focused, targeted attacks. Once scanned, the codes can redirect victims to counterfeit login pages mimicking Microsoft accounts or internal company portals, harvesting usernames, passwords, and other sensitive information.

In other cases, attackers pose as HR departments, sending emails that urge employees to view or sign documents such as leave schedules or termination lists. These messages ultimately funnel users to fake authentication pages designed to steal credentials. Another growing tactic involves bogus invoices or purchase confirmations delivered via PDF attachments. Victims are sometimes encouraged to call phone numbers listed in the documents, combining QR phishing with voice-based social engineering to deepen the attack.

Such campaigns prey on familiarity and trust in everyday workplace communications, often resulting in compromised accounts, data leaks, and financial losses.

“QR-code-based phishing has emerged as one of the most successful attack techniques this year, particularly when embedded in PDFs or masked as legitimate business messages like HR alerts,” said Roman Dedenok, Anti-Spam Expert at Kaspersky. “The sharp rise in November shows how attackers are exploiting this low-cost method to target employees on mobile devices, where security protections are frequently weaker.”

To counter the growing threat, Kaspersky advises organizations to strengthen email security with solutions capable of detecting image-based attacks. Tools such as Kaspersky Security for Mail Server can help protect corporate email systems against spam, phishing, business email compromise, QR code threats, and other email-borne risks.

By Aaradhay Sharma