CYBERSECURITY MONTH 2026
QR code phishing
Measure QR-code risk in offices, parking lots, restaurants, internal posters and event materials.
- email, mobile, field and voice
- Multi-channel
- based on observed behavior
- Retargeting
- contextual pages and feedback
- Education
email, mobile, field and voice
based on observed behavior
contextual pages and feedback
What is QR code phishing?
New QR code phishing campaigns have emerged, designed to collect targets' information or infect them with malware. Attackers are exploiting a habit formed during the COVID-19 pandemic: scanning a code without wondering where it leads.
QR codes sidestep the usual protections. They carry no readable link, so there is nothing to hover over or check before clicking. They are often scanned from a personal device, outside the company's protected perimeter, and they arrive on a physical medium people instinctively trust: a poster, a flyer, a menu.
To help you run your campaign, we built into the BlueSecure platform a tool for scheduling QR code phishing campaigns and analysing the results.
How the attack unfolds
The attacker places QR codes in strategic spots: a building entrance, a flyer, a car park payment terminal, a restaurant menu. The target, used to scanning since the pandemic, does so with their personal device and enters their work credentials. The attacker can then launch a series of actions that undermine the information system's security: collecting sensitive data, or infecting the device with malware.
- Codes placed where people expect them
- Scanned from a personal device, outside the perimeter
- Work credentials entered in good faith
Codes placed where people expect themWhat the campaign helps you test
Scenario
Test scanning habits and the ability to verify the real destination.
Targeting
Deploy physical materials for Cybermonth, onboarding, events or sensitive sites.
Reporting
Attach each QR code to an educational page and campaign tracking.
Analysis
Connect field-channel signals to Phishing 360 metrics and risk scoring.
Deploy with minimal friction
- MaterialPoster, flyer, sticker or event material adapted to the location.
- Tracked QRCampaign link, educational landing page and tracking by material.
- Field rolloutDeployment in relevant zones with security scoping.
- AnalysisResults by site, audience, period and message type.
Frequently asked questions
- Can QR codes be combined with another channel?
- Yes, and it is the most realistic scenario. We schedule an email carrying a QR code unique to each recipient, which allows precise, targeted analysis of the results, where a poster only yields an overall figure.
- Should posters be placed on site as well?
- It is an excellent complement. Posters carrying a QR code that leads to a login or awareness page, placed in shared areas, make people accountable exactly where the attack would really happen.
- How do we train after the campaign?
- Our awareness modules cover the newer phishing techniques as short videos followed by a quiz, which confirms the skills have landed. People who are caught are directed there automatically.
- Is the solution GDPR compliant?
- We apply a personal data protection policy in line with GDPR principles. Privacy impact assessments are carried out regularly to maintain a high level of data security day to day. Our AFNOR-certified DPO oversees ongoing compliance, in particular data minimisation and respect for individual rights.
Build a campaign around your real exposure
BlueSecure can combine this channel with the other Phishing 360 channels depending on your risk profile: email, SMS, QR code, USB, physical mail, physical intrusion, vishing and voice deepfake.