GTconsult - Blog #quishing 2026GTconsult - Blog #quishing 2026https://www.gtconsult.com/blogs/tag/quishing-2026Wed, 15 Jul 2026 08:51:55 -0700http://zoho.com/sites/<![CDATA[Why a Bigger Bucket Doesn't Help If the Holes Keep Moving]]>https://www.gtconsult.com/blogs/post/why-a-bigger-bucket-doesn-t-help-if-the-holes-keep-movingMicrosoft detected 8.3 billion phishing emails in Q1 2026. QR code phishing grew 146%. Here's what's actually changing, and what M365 admins should do this week.]]>

A bucket with five small holes leaks slower than a bucket with one big hole. It still leaks though, and if you're only checking for the big hole, you'll miss all five small ones.

That's roughly the position most organisations' email security is in right now.

The Number That Doesn't Matter as Much as You'd Think

Between January and March 2026, Microsoft Threat Intelligence detected approximately 8.3 billion email-based phishing threats. Monthly volumes started at 2.9 billion in January and settled at 2.6 billion by March.


That's a genuinely large number. It's also roughly the same scale of phishing volume Microsoft has reported for several quarters running. The headline figure staying flat isn't the interesting part of this report. Where the attacks are landing is.

QR Code Phishing: The Fastest-Growing Vector

QR code phishing grew 146% over the quarter, from 7.6 million attacks in January to 18.7 million in March, the highest monthly volume Microsoft has observed in at least a year.


The mechanics are straightforward once you see them. Attackers embed a malicious QR code in an email, often inside a PDF attachment (70% of QR phishing was PDF-delivered by March). The link is encoded in the image, not in the email body as a clickable URL. Most email security filters scan URLs in the message text and headers. They don't reliably extract and scan URLs embedded inside an image.


The user receives the email, sees the QR code (often presented as a document verification step or an MFA prompt), and scans it with their phone. Their phone, typically outside the corporate security perimeter, opens a credential harvesting page. The user enters their credentials. The attacker has them.

This matters because the entire attack happens outside the corporate network, outside the managed browser, and outside whatever endpoint detection you've deployed on corporate devices. The phone becomes the unprotected attack surface.


CAPTCHA-Gated Phishing: Making Malicious Pages Look Legitimate

CAPTCHA-gated phishing surged 125% in March alone, reaching 11.9 million attacks, the highest monthly volume observed in the past year.


The technique adds a CAPTCHA or human-verification step before the phishing page loads. This does two things at once: it makes the page feel more legitimate to a human (“a real site would have a CAPTCHA”), and it prevents automated security scanners from reaching and analysing the actual phishing page behind it.


A real visitor solves the CAPTCHA and reaches the fake login page. An automated crawler gets stuck at the CAPTCHA wall and walks away. The phishing URL stays live and undetected for longer than it otherwise would.

Tycoon2FA: What a Takedown Actually Buys You

Microsoft, working with law enforcement and industry partners, disrupted the Tycoon2FA phishing-as-a-service platform during the quarter, which had previously dominated CAPTCHA-based attacks. The takedown led to a measurable, real decline in phishing volume tied to that specific platform.


It's a useful case study, and also a reminder of how this actually works. Platform-level takedowns have genuine, measurable impact. They're also rarely permanent. Threat actors shift to alternative platforms, adjust their tactics, and rebuild. A volume decline tied to one disruption is real, but it's not the same as the underlying threat disappearing.

What M365 Admins Should Actually Do This Week

•  Review your Exchange Online Protection settings and confirm the baseline defences Microsoft recommends are actually in place, not just assumed.


•  Enable Zero-hour Auto Purge (ZAP) in Defender for Office 365. ZAP retroactively quarantines malicious messages delivered before the threat was identified. If it's not enabled, you're relying entirely on pre-delivery detection.


•  Update your phishing simulation programme to include QR code and CAPTCHA-gated scenarios. If your simulations don't cover these, you're training your team against last year's threats. Microsoft's Attack Simulation Training in Defender for Office 365 now supports simulations in Teams as well as email.


•  Audit your inbound mail flow rules for legacy exceptions that might be bypassing security scanning for specific senders or domains.


•  Brief your team on the QR code vector specifically. The defence here isn't purely technical, it needs user awareness and mobile device policies that extend your perimeter to personal devices.

The Pattern Underneath All of This

The common thread across QR codes, CAPTCHA gates, and the rest is that attackers are investing more in psychology than in technology. They're not building more sophisticated malware. They're building more convincing delivery mechanisms that exploit trust: trust in physical-world verification, trust in website legitimacy, trust in organisational communication patterns.


Technical defences matter and they're listed above. But user awareness, an updated simulation programme, and a culture that makes it easy to report something suspicious are what actually close the gap between a new attack vector appearing and your organisation noticing it.

Frequently Asked Questions

QR code phishing, sometimes called quishing, is a phishing technique where the malicious link is encoded inside a QR code image rather than placed as clickable text in the email body. Because the link isn't readable as text, many email filters don't detect it. The target scans the code, usually with a personal phone outside the corporate security perimeter, and lands on a credential-harvesting page.

Microsoft recorded a 146% increase in QR code phishing volume between January and March 2026, rising from 7.6 million to 18.7 million attacks. The growth is largely attributed to the technique's ability to bypass traditional URL-scanning filters, since the link is embedded in an image rather than as scannable text.

CAPTCHA-gated phishing places a CAPTCHA or human-verification step in front of the actual phishing page. This serves two purposes for the attacker: it makes the page feel more legitimate to a human visitor, and it blocks automated security scanners from reaching and flagging the page behind the gate.

Microsoft Defender for Office 365 includes detection capabilities aimed at QR code threats, but coverage depends on configuration, including Zero-hour Auto Purge and updated Attack Simulation Training scenarios. Organisations should confirm these specific settings are enabled rather than assuming default coverage is sufficient.

The most effective defences combine technical controls (ZAP, mail flow rule audits, updated EOP settings) with updated security awareness training that specifically includes QR code and CAPTCHA-gated scenarios, since these vectors are designed to bypass both filters and user intuition built around older phishing patterns.

If you want help reviewing your current email security configuration against these specific vectors, get in touch and we can help.

A Team Protection
]]>Wed, 15 Jul 2026 14:22:52 +0000