How Cloudflare Cloud Email Security protects against the evolving threat of QR phishing

QR codes: the phishing vector that evades email scanners

QR codes have been around for three decades, but the COVID-19 pandemic turned them into everyday tools for checking statuses, registering for events, and ordering food. That widespread familiarity has made them an attractive phishing vector. QR phishing, or “quishing,” works like traditional phishing in its goals — credential theft, device compromise, financial loss — but the delivery mechanism is fundamentally different. Instead of embedding a clickable URL or malicious attachment in an email, attackers embed a QR code that directs victims to a malicious destination when scanned.

The core advantage for attackers is that phish detection engines are built to analyze URLs and attachments, not images. A URL in an email can be crawled and followed through redirects to a malicious site, triggering detection. A QR code, however, presents no URL for the engine to crawl. Reading a QR code requires computer vision, a completely different capability from URL analysis. As a result, quish can bypass detection engines that would easily catch a traditional phish with the same payload.

Why attackers favor QR codes

QR codes are a preferred phishing tool for three primary reasons.

1. They resist machine analysis. QR codes are designed with strong error correction, so they can withstand resizing, partial cropping, lighting variations, and other distortions. While computer vision models can scan QR codes, identifying which section of an email or image contains one is difficult — especially when the code has been obfuscated. Attackers can invert colors, blend codes into images, or shrink them to near-invisibility. Applying filters to deobfuscate an image is computationally expensive when you don't know what to look for or where. The risk of false positives also causes delivery delays for legitimate emails, making aggressive scanning impractical.

Critically, obfuscation that defeats machines often doesn't defeat humans. People can increase screen brightness, print the email, or resize the image to successfully scan codes that stumped automated systems.

2. Victims scan from unprotected personal devices. QR codes are typically scanned with personal smartphones, not secured corporate endpoints. Corporate devices often have safeguards that warn, block, or sandbox users when they access malicious links; personal devices generally do not. This is especially concerning given the observed trend of custom QR codes targeting executives.

3. They layer with other obfuscation techniques. QR codes can be combined with encrypted attachments, lookalike domains, human verification checks, and other tricks. Attackers can add QR codes to previously successful phishing campaigns that security products now block, reviving old vectors with a new twist.

Cloudflare's detection approach

Cloudflare's cloud email security solution, previously known as Area 1, has addressed quishing since 2020. Rather than relying on layered email configuration rules, the service uses machine learning models trained on nearly a decade of detection data, plus proactive computer vision models, to provide a turnkey defense.

Quish detection is broken into two stages:

Stage 1: Finding and scanning QR codes. Custom heuristics inform when, where, and how computer vision models execute. The system uses updated libraries to identify, process, and decode QR codes. Because obfuscation methods are constantly evolving, these tools must be regularly updated to keep pace with trending techniques.

Stage 2: Analyzing decoded content. Once a QR code is decoded, the resulting content receives the full phish-detection treatment — and more. Engines deconstruct complex URLs, following each redirect until reaching the final destination. Along the way, the system scans for malicious attachments and websites, logging findings for future cross-referencing. Encrypted or password-protected files are passed to decryption engines. Observed obfuscation methods and other data are continuously fed back into detection databases.

The analysis pipeline also accounts for blockers that stymie automated crawlers. Some campaigns require CAPTCHA completion or only reveal malicious content to targets meeting specific regional or technical criteria; everyone else sees a benign website. Cloudflare has built tools to pass these validations. Where final content remains unreachable, link reputation models trained on years of scanned links and metadata make inferences based on domain metadata, URL structure, query strings, and historical data. ML models also proactively identify where QR codes may be hidden in emails and scrutinize sender-recipient social patterns, domain reputation, and contextual signals to neutralize threats.

Real-world impersonation patterns

Among the thousands of QR codes processed daily, some notable impersonation targets stand out: Microsoft and DocuSign. Both companies legitimately use QR codes in their workflows, which makes phishing emails mimicking them particularly effective — users may not find a QR code in an email unusual.

Microsoft Authenticator. Microsoft uses QR codes to streamline MFA setup, avoiding delayed SMS codes that are also vulnerable to SIM swap attacks. Attackers exploit this by sending emails claiming users need to re-authenticate — a plausible request since users have seen similar legitimate registration screens.

DocuSign. DocuSign uses QR codes for mobile app downloads, identity verification via mobile cameras, and third-party app integrations with built-in QR scanning. While QR codes aren't used in signature requests themselves, frequent users may see one and assume it's a quick way to open a document in the mobile app.

Microsoft Teams. Teams supports QR codes for joining teams from mobile devices and has a voicemail feature. Phishing emails combine both into a fake voicemail notification containing a malicious QR code.

How to contribute to quishing defense

Cloud Email Security customers can submit quish samples through the portal, helping stop active threats and train future machine learning models. Non-customers can submit original samples as EML attachments to [email protected]. Organizations using other email security providers should follow those providers' submission processes as well.

The fight against quishing requires ongoing innovation and collaboration. Cloudflare is developing new methods for customers to provide targeted model feedback and adding transparency to detection metrics to better track quishing and other attack vectors.