Threat Landscape - QR Code / Quishing Tactic (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•3•0•5

Identifies emails with low text content but containing image attachments (.png/.jpg) associated with QR code "Quishing" attacks, a rising Q1 trend. The rule specifically looks for image attachments with filenames containing keywords like 'scan', 'qr', 'barcode', 'auth', or 'mfa', and joins this with email events that have no URLs, indicating the QR code is the primary call to action.