Top Characteristics of a QR Code Phishing Email

Cofense highlights how QR code phishing campaigns have expanded in scale and sophistication, with QR images most often embedded directly in email but increasingly delivered via attachments (especially PDFs) or rendered dynamically using Google Charts to evade scanners. The most common characteristics include captchas and MFA-themed lures, while subjects show higher rates of MFA themes, dates, and redactions for PII. URLs embedded in QR codes frequently leverage legitimate redirectors (notably Bing and Google), link shorteners, and QR-focused tracking services alongside malicious or compromised domains, indicating a broadening set of techniques designed to bypass enterprise controls and deceive users on personal devices.