QR Code Phishing (Quishing) Attack Your Smartphones To Steal Microsoft Accounts Credentials

Researchers report an increase in “quishing” — QR-code-based phishing campaigns that embed malicious redirects to steal credentials (notably Microsoft accounts). Attackers leverage legitimate redirects and anti-bot verification to evade detection, present pre-populated fake login pages, and have targeted sectors including healthcare, automotive, energy, and education across the U.S. and Europe; documented IoCs include PDFs with embedded QR codes, redirect URLs, and fake login pages. Organizations are advised to use URL/DNS filtering, endpoint controls, and employee training to mitigate the threat.