QR Phishing. Fact or Fiction?

The report analyzes “Quishing” (QR code phishing), where attackers embed base64 QR codes in emails to evade URL scanning and entice users to scan on mobile devices with weaker defenses, then leverage AiTM proxies to capture M365 credentials and session tokens for broader access (e.g., VPN). It critiques widely cited volume statistics, notes that while vendors claim detection capabilities the technical controls remain immature, and recommends prioritizing user awareness and training while calibrating risk relative to traditional URL phishing.