Scammers are increasingly using visually stylized QR codes to deliver phishing links, reports Help Net Security, a cybersecurity news outlet. QR code phishing (quishing) is already more difficult to detect because these codes deliver links without a visible URL.
Quishing attacks are even showing up on the streets of downtown Raleigh.
Fake QR codes marked “Scan Here to Pay for Parking” were found posted on street parking meters in December 2025. City officials removed the fake codes and warned they might be part of a wider scam.
Attackers are now also using QR codes with colors, shapes and logos woven into the code’s pattern, which makes it more difficult to detect.
“Fancy QR codes further complicate detection,” Help Net Security says. “Their layouts no longer resemble the familiar black and white grid. Logos appear in the center. Modules become rounded, stretched or recolored. Background images blend into the code. These design changes preserve scan success while disrupting visual and structural assumptions used by existing detection tools.”
Help Net Security cites a report from Deakin University that looked at these “fancy” QR codes, in which the researchers noted that these “artistic and aesthetic QR codes are created by blending an image with black-white QR code where their modules are almost unidentifiable to [the] human eye.”
Quishing is also a threat because people usually scan them with their phones, bypassing any security defenses their employer might have on their work computers. These codes can also be placed as stickers in physical locations.
“According to reporting by NordVPN, 73% of Americans scan QR codes without verifying the destination, and more than 26 million users have been redirected to malicious websites,” Help Net Security writes.
“In 2025, the U.S. Federal Trade Commission warned consumers that QR codes on unexpected packages should be treated as suspicious. New York City’s Department of Transportation issued a similar warning after discovering fraudulent QR codes placed on parking meters.”
This article is redistributed with permission from KnowBe4.