The Trail: From AITM to the Resurgence of QR Code Phishing

The Trail-From AITM to the Resurgence of QR Code Phishing-Blog Inline Image
Threat actors have a habit of recycling old techniques with new delivery methods, and QR code phishing, also known as “Quishing”, is just another example. Just a week after Gurucul published a thorough analysis into Adversary-in-the-Middle (AITM) attacks, a similar threat vector has emerged as malicious QR codes embedded in phishing emails. These attacks are gaining momentum, exploiting both end-user trust and the gaps in traditional security tools. Much like AITM, QR-based phishing sidesteps email gateway protections and leverages trusted access to compromised identities.

Real-World Detection: A Quishing Attack Uncovered

At a recent customer site, Gurucul’s analytics detected a QR code phishing attempt that completely bypassed legacy email gateways and network/endpoint detection tools. The attack used an embedded QR code in an email attachment to redirect users to a spoofed login page. The scan redirected victims to a credential-harvesting site that imitated a legitimate identity provider. What made this case significant was that traditional tools failed to generate an alert. Gurucul’s behavioral analytics and entity risk scoring models, however, flagged the incident based on a chain of correlated anomalies.

QR Code Phishing (Quishing)

How Gurucul Detects QR Code Phishing (Quishing) Attacks

Gurucul detected QR code phishing campaigns by connecting data across multiple silos:

Cross-Platform Behavior Correlation

Email Gateway Metadata: Identifies anomalies in attachments or email sender domain.
Web Proxy Logs: Flags QR-originated traffic leading to newly registered or untrusted domains.
Identity Provider Logs: Detect abnormal authentication attempts post-scan.
Cloud Audit Logs: Captures suspicious changes in identity settings or privileges.
Geo-Intel and Credential Abuse Patterns: Combines geo-anomalies, password stuffing patterns, and threat intel data to establish high-confidence alerts.

Suspicious Activity Chaining

Beyond siloed analysis, Gurucul stitches together weak signals to reveal the full attack chain:

A benign-looking email from unusual sender domain
User scan activity from a personal device
Unusual redirect through proxy
Token theft or credential submission
Suspicious login attempt from a new location/device, unusual ISP
Gurucul’s Chain Model helps in detection of post-compromise behaviors, such as Lateral Movements, privilege escalation, internal phishing campaigns, etc.

Looking Ahead

As phishing techniques evolve, so must our approach to detection. QR code scams are increasing, but they’re only a small part of a much bigger problem. Generative AI is now being used by threat actors to launch highly targeted social engineering and phishing attacks, especially against less tech-savvy industries. These AI-powered campaigns personalize attacks, increasing their speed and scale beyond the capabilities of traditional defenses.

As identity remains the new perimeter, and deception the weapon of choice, Gurucul’s behavioral analytics and advanced threat correlation continue to offer a critical edge against modern attack techniques.

Frequently Asked Questions

What is Quishing, and how is it different from traditional phishing?

Quishing is a form of phishing that uses QR codes instead of clickable links to trick users into visiting malicious sites. Unlike traditional phishing, these attacks often bypass email security tools by hiding harmful URLs inside image-based QR codes, making them harder to detect.

How do QR code phishing attacks evade legacy security tools?

Legacy tools typically scan emails for suspicious links or attachments. Quishing bypasses these checks by embedding the malicious URL in a QR code image. When users scan the code with a mobile device, they’re redirected to spoofed login pages, triggering credential theft — all without tripping standard email filters or endpoint protections.

How does Gurucul detect Quishing attacks others miss?

Gurucul correlates behaviors across silos — including email metadata, proxy logs, identity provider activity, and geo-intel — to identify the entire attack chain. Our platform flags anomalies like QR-based redirects, abnormal authentication patterns, and privilege changes, even when traditional tools generate no alerts.

Why is Quishing part of a broader trend in cyber threats?

QR-based phishing is just one example of how attackers are repurposing old methods with new delivery mechanisms. With generative AI accelerating the speed and personalization of attacks, behavioral analytics and cross-platform correlation are essential to detect and stop threats before damage is done.