QR Codes Exploited for Phishing Attacks and Malware Spread on Mobile Devices

QR code abuse has become a significant mobile threat vector, with attackers using it to deliver phishing pages, trigger in‑app account takeovers, and distribute malicious applications outside official app stores.

Because people routinely scan QR codes for payments, menus and app downloads, these attacks often bypass enterprise protections by shifting the interaction onto less‑protected personal smartphones.

Recent telemetry shows that security crawlers observe tens of thousands of QR codes on webpages every day, with a substantial subset leading to malicious destinations, including credential‑harvesting sites and scam portals.

Criminals increasingly embed these QR codes in emails, documents and websites, taking advantage of the fact that many email filters and web proxies still have limited visibility into QR‑encoded content compared with plain URLs.

This trend aligns with broader phishing growth: the APWG reported more than 1 million phishing attacks in Q1 2025 and noted widespread use of QR codes to evade filtering and redirect users to phishing or malware sites.

Attackers commonly chain multiple redirects to hide the final destination, starting with a benign‑looking domain, passing through a URL shortener and finally landing on a phishing page impersonating services such as webmail or cloud platforms.

These campaigns are often tailored for mobile, using responsive fake login pages and CAPTCHAs to appear legitimate and to discourage analysis by automated tools.

Industries such as financial services, high tech and retail are frequent targets due to their heavy reliance on QR‑based payments, promotions and customer engagement flows.

QR Codes Exploited for Phishing Attacks

A key evolution in QR‑based attacks is the use of QR code shorteners that turn a static image into a dynamic, attacker‑controlled redirect, allowing threat actors to change the landing URL at any time while retaining the same printed or shared code.

Recent analysis identified tens of thousands of host pages embedding QR codes that link directly to more than a thousand distinct APKs, including gambling, casino and “phone optimization” apps requesting extensive permissions such as camera access, location tracking, external storage read/write and account management.

Previous Unit 42 research has covered several key attack vectors for phishing QR codes hosted on documents, which are also relevant when hosted on websites. 

Telemetry from recent research indicates steady growth in traffic to popular QR code shortening services between 2023 and 2025, and highlights domains such as qrco[.]de, me‑qr[.]com and qrs[.]ly as frequent components of malicious chains, with qrs[.]ly appearing in over 7% of observed malicious QR URLs.

Because these shortener domains often have reasonable reputations, both users and security tools may trust them, making it harder to spot phishing until after credentials are entered or malware is downloaded.

Financial services was the most impacted industry when considering compromised QR code shorteners, accounting for 29% of this type of attack.

In‑app deep links add another layer of risk by letting QR codes open specific views or actions inside mobile apps instead of just launching a browser.

Attackers exploit deep links in messaging and social media apps such as Telegram, Line, WhatsApp and Signal to trigger login flows that effectively authorize an attacker‑controlled device or session on the victim’s account.

Google’s Threat Intelligence Group has documented Russia‑aligned actors abusing Signal’s legitimate “linked devices” feature via malicious QR codes, enabling long‑term interception of messages from Ukrainian military and government targets.

Similar deep‑link‑based flows can be used for financial fraud, for example by pre‑populating cryptocurrency payment requests in a wallet app or triggering payment actions in mobile payment platforms.

Direct APK downloads

QR codes are also being used to distribute Android applications directly, bypassing vetting mechanisms in official app stores and pushing users to install APK files hosted on attacker‑controlled infrastructure.

Because installing APKs from unknown sources is still common in certain regions and verticals, QR‑driven sideloading is an attractive vector for threat actors to deliver spyware, banking trojans or adware at scale while sidestepping app store review.

Threat reports from mobile security vendors show that such APK files often blend aggressive advertising, click‑fraud and credential theft, using their broad permissions to exfiltrate sensitive data or install additional payloads.

Organizations should treat unsolicited QR‑based app install prompts especially those originating from ads, social media or untrusted websites as high‑risk, and enforce device policies that block or monitor non‑store installations on corporate‑managed mobiles.

To reduce exposure, defenders should combine user education about QR risks with improved technical controls, including QR‑aware URL filtering, mobile sandboxing for deep‑link behavior and strict controls on sideloaded apps.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.