QR Codes Exploited for Phishing Attacks and Malware Spread on Mobile Devices

Cybersecurity: QR Code Exploitation in Phishing Attacks

QR code exploitation has emerged as a significant mobile threat vector, with attackers utilizing it to deliver phishing pages, execute in-app account takeovers, and distribute malicious applications outside official app stores.

Individuals frequently scan QR codes for payments, menus, and app downloads, leading to these attacks often bypassing enterprise protections by redirecting interactions to less-secure personal smartphones.

Recent data indicates that security systems observe tens of thousands of QR codes on web pages daily, with a notable portion leading to malicious destinations, including credential-harvesting sites and scam portals.

Criminals are embedding these QR codes in emails , documents, and websites, exploiting the limited visibility many email filters and web proxies have into QR-encoded content compared to plain URLs.

This trend corresponds with the broader increase in phishing incidents. Attackers typically chain several redirects to conceal the final destination, starting with a legitimate-looking domain, passing through a URL shortener, and ultimately landing on a phishing page impersonating services such as webmail or cloud platforms.

These campaigns are often designed for mobile devices, utilizing responsive fake login pages and CAPTCHAs to appear legitimate and deter analysis by automated tools.

Industries such as financial services, high tech, and retail are frequent targets due to their reliance on QR-based payments, promotions, and customer engagement processes.

QR Codes Exploited for Phishing Attacks

A recent development in QR-based attacks is the use of QR code shorteners that convert a static image into a dynamic, attacker-controlled redirect. This allows threat actors to modify the landing URL at any time while maintaining the same printed or shared code.

Analysis has identified tens of thousands of host pages embedding QR codes that link directly to numerous distinct APKs, including gambling, casino, and “phone optimization” apps requesting extensive permissions such as camera access, location tracking, external storage read/write, and account management.

Telemetry from recent research highlights growth in traffic to popular QR code shortening services between 2023 and 2025. It identifies domains such as qrco[.]de, me‑qr[.]com, and qrs[.]ly as frequent components of malicious chains, with qrs[.]ly appearing in over 7% of observed malicious QR URLs.

These shortener domains often possess reasonable reputations, which may lead users and security tools to trust them, complicating the detection of phishing until credentials are entered or malware is downloaded.

Financial services were the most affected industry regarding compromised QR code shorteners, accounting for 29% of this type of attack.

QR codes are also being used to distribute Android applications directly , bypassing the vetting mechanisms in official app stores and encouraging users to install APK files hosted on attacker-controlled infrastructure.

Since installing APKs from unknown sources is still common in certain regions and sectors, QR-driven sideloading is an attractive vector for threat actors to distribute spyware, banking trojans, or adware at scale while avoiding app store review.

Threat reports from mobile security vendors indicate that such APK files often blend aggressive advertising, click-fraud, and credential theft, using their broad permissions to extract sensitive data or install additional payloads.

Organizations should treat unsolicited QR-based app install prompts, especially those from ads, social media, or untrusted websites, as high-risk. They should enforce device policies that block or monitor non-store installations on corporate-managed mobiles.

To mitigate exposure, defenders should combine user education about QR risks with enhanced technical controls, including QR-aware URL filtering, mobile sandboxing for deep-link behavior, and strict controls on sideloaded apps.

Based on reporting by GBHackers.