PDF Quishing Attacks | Cyber Attacks – Technologist

Hackers are increasingly refining their phishing techniques, using malicious QR codes hidden within PDF email attachments to bypass traditional email security scanners. According to new research, more than half a million of these attacks have been detected over the last three months. Below, we discuss how and why hackers are using advanced “quishing” attacks by hiding malicious QR codes in PDF email attachments.

As cyber security providers, we understand the ever-changing landscape of social engineering tactics like phishing. This manipulation often involves users unwittingly scanning seemingly legitimate QR codes, which then redirect them to phishing sites. This underscores the critical role of user awareness in our cyber security strategy.

How are the cyber attacks occurring?

Recent findings show that attackers are shifting from embedding QR codes directly in emails to concealing them within attached PDFs—making detection by conventional email scanning tools much harder.

The attackers typically impersonate trusted organisations, with Microsoft-related services such as SharePoint and OneDrive comprising over 50% of the qishing attacks observed. Additionally, brands like DocuSign and Adobe have been leveraged in many of these malicious campaigns.

What industries are being attacked?

These attacks are particularly concerning for industries managing sensitive information—such as finance, healthcare, and education—as they exploit weaker security layers in sectors where data protection is critical. SMBs are especially vulnerable as they often lack the robust cybersecurity defences to fend off such advanced techniques.

Why is this phishing attack more advanced?

One of the core challenges with this new phishing tactic is the use of multiple devices. Employees might scan QR codes with personal phones, which generally have fewer security protections than corporate-issued devices. This further complicates detection and increases the attack surface.

PDF Quishing Attacks – How you can protect your business

With the proliferation of ASCII/Unicode-constructed phishing QR codes, it’s crucial for security professionals to adopt a proactive stance. Relying solely on email security solutions may not be enough to combat these sophisticated threats. A comprehensive, layered cybersecurity approach, coupled with heightened user awareness and regular updates to detection capabilities, is the key to staying ahead of the game.