Smashing smishing by quashing quishing

## Overview Andrew Brandt, principal researcher at Netcraft and former cybercrime journalist, traces how QR-code phishing ("quishing") evolved from targeted smishing into a widespread 2025 threat.

## Attack Mechanics Victims receive messages with QR codes whose URLs often embed the target's email address. Domains are frequently registered one day before attacks. Landing pages frame legitimate Microsoft login flows inside weaponized pages whose scripts capture credentials and MFA codes in real time.

## Phishing Kits and Scale Brandt links campaigns to kits such as Onyx, Tycoon 2FA, and Rockstar 2FA that proxy authentic login pages. He highlights a mobile UX problem: photographing a QR code on screen often triggers the link accidentally. At Netcraft, similar quishing lures now appear across many industries.

## Takeaways Defenders should treat quishing like credential phishing, monitor freshly registered domains, and train users that QR codes are untrusted hyperlinks—not harmless images.