• •Acronis identified QR code phishing as a leading threat vector for 2026, noting its ability to bypass traditional email gateway filters.
• •The attack method relies on redirecting users to malicious sites through mobile devices that lack enterprise-grade endpoint security.
• •It remains unclear whether automated detection tools currently in development will effectively neutralize image-based link obfuscation.

Security researchers at Acronis have identified QR code phishing, or 'quishing,' as a primary blind spot for enterprise security systems heading into 2026. Unlike traditional link-based phishing, these attacks bypass standard text-filtering email gateways by embedding malicious URLs within images that evade metadata scanning. However, defenders face friction as mobile device management (MDM) solutions often struggle to monitor browser activity at the same granularity as desktop platforms. This shift highlights a growing vulnerability in hybrid work environments, where the gap between mobile device usage and organizational security protocols may determine the next major wave of data breaches.