QR codes are ubiquitous: they are on restaurant menus, parking meters, conference badges, and product packages. But as users grow comfortable scanning black-and-white pixel grids with their smartphones, cybercriminals have adopted 'Quishing' (QR Phishing) as one of the fastest-growing attack vectors of 2026.
What is 'Quishing' and Why is it Exploding?
Traditional phishing emails contain text links (e.g. http://malicious-login-fake.com). Enterprise email security gateways (like Proofpoint and Microsoft Defender) have become remarkably adept at inspecting text links and blocking them before they reach your inbox.
To evade email security scanners, attackers now embed malicious URLs inside an image of a QR code:
- Traditional email filters see only an innocent PNG or JPG attachment and let the email through.
- The email urges the user to scan the QR code with their mobile phone to 'review an urgent invoice' or 'verify two-factor authentication.'
- The user scans the QR code on their personal smartphone, shifting the attack off the protected corporate network and onto an unmonitored mobile device.
Static Public QR Codes vs Ephemeral Pairing QR Codes
Not all QR codes are created equal. It is vital to understand the difference between dangerous static QR codes and secure peer-to-peer pairing codes:
Dangerous: Static Public QR Codes
Physical QR codes posted on public parking meters or unverified flyers can be easily covered up by malicious stickers containing redirects to malware downloaders or credential harvesting pages. Never scan a public QR code that asks you to enter passwords or download APK/configuration profiles.
Secure: Ephemeral Peer Pairing QR Codes (Sendly)
When you pair two devices on Sendly, the QR code does not contain a static public download URL. Instead, it encodes a temporary, short-lived cryptographic session handshake token:
- The token is valid for only a few minutes.
- It can only be redeemed once to establish the initial WebRTC signaling handshake.
- No third party can reuse or scan the code after the session is established.
4 Rules for Safe QR Scanning in 2026
- Preview the Destination URL: Most smartphone camera apps display a preview of the domain before opening it. If the domain looks misspelled or suspicious (e.g.
pay-park1ng-secure.xyzinstead of the official city domain), cancel immediately. - Never Authorize Mobile Device Management (MDM) Profiles: If scanning a QR code prompts your phone to download a configuration profile or device management certificate, decline instantly.
- Keep Pairing Codes Local: Only scan pairing QR codes generated live on your own trusted laptop or desktop screen.
- Use Built-in URL Inspectors: If you receive an unfamiliar QR code or short link, run it through a link inspector tool before navigating to it.