Quishing

QR codes became everyday during the pandemic, on menus, posters and parking machines, and scammers followed. A code can be printed on a sticker, pasted into a PDF or sent by email, and nobody can tell where it leads just by looking.

Microsoft counted more than 145 million QR phishing attacks in a year, most of them hidden in PDF attachments. The code is aimed at your phone on purpose: work computers have filters that check links, while the personal phone you scan with often doesn't.

AI makes the page behind the code better. Phishing kits now use generative AI to build convincing pages in any language in minutes, so the parking or parcel page you land on can look exactly like the real one.