QR Code Phishing Surged 146% in Q1 2026: What DMARC Can and Cannot Stop

Sun, 24 May 2026 08:00:00 +0000

Microsoft Threat Intelligence published its Q1 2026 email threat landscape report on April 30. The headline figure was 8.3 billion email-based phishing threats detected in the first three months of the year. Monthly volumes ran from 2.9 billion in January to 2.6 billion in March, which sounds like a decline until you read what was actually growing inside those numbers.

QR code phishing, a technique security researchers call quishing, grew 146% over the quarter, rising from 7.6 million attacks in January to 18.7 million in March. It was the fastest-growing attack vector tracked in the report. In March alone, QR codes embedded directly in email bodies rather than inside attachments surged 336%. CAPTCHA-gated phishing more than doubled in the same month.

Quishing on Daily DMARC News

QR Code Phishing Surged 146% in Q1 2026: What DMARC Can and Cannot Stop