Quick...where do you see QR codes on your campus?
Lunch menus. Parking permits. Event flyers. Form submissions. Student handbooks. They're everywhere and they're convenient, contactless, and ubiquitous.
Attackers know this.
Microsoft reports that 15,000+ emails containing malicious QR codes target the education sector daily, and the FTC issued a consumer alert. Meanwhile, faculty, staff, and students scan these codes without thinking twice.
Here's the problem...most email security tools can't see them.
QR codes are images. Legacy email security tools (including many Secure Email Gateways) were built to scan links and text. An image with an embedded URL? That requires different technology entirely.
So, when an attacker sends a fake UCPath payroll notification with a QR code linking to a credential harvesting site, a SEG will often wave it through. By the time an unsuspecting user scans it, their credentials are gone.
(UCPath is the University of California's payroll and benefits system, attackers knew UC Berkeley employees would trust notifications from this familiar platform.)
Now...let's break down how this attack works, why education is the perfect target, and what detection actually requires.
The anatomy of a QR code phishing attack is deceptively simple:
Step 1: Attacker crafts a legitimate-looking email (IT notification, payroll update, building access, school registration)
Step 2: Email includes a QR code instead of a clickable link
Step 3: User scans with their phone, bypassing all email and campus security
Step 4: QR code redirects to credential harvesting site or malware download
Your environment can be QR code-dense at times. Students and staff are conditioned to scan constantly. You're managing thousands of users with lean IT teams. And unlike corporate environments where QR codes raise suspicion, in education they're expected.
Need to register for an event? Scan the QR code.
Forgot your parking permit? Scan the QR code on your phone.
Cafeteria menu for the week? QR code on the bulletin board.
Submit a permission slip? QR code in the email.
This normalization makes education environments uniquely vulnerable. Users don't question QR codes, they expect them.
In 2024-2025, UC Berkeley experienced what their security office called a "spike in sophisticated tactics" targeting employee payroll. Attackers impersonated UCPath (the University of California's payroll system) using:
Subject lines designed to create urgency, like "My UC Berkeley profile contact," "New Email Update," and "Important Update."
Fake Google Ad for "UCPath" directing to malicious domain ucpathidproxyca.com. When employees searched for their payroll system, this sponsored ad appeared above legitimate results—redirecting to a credential harvesting site.
The goal? Steal credentials, redirect direct deposit. Multiple attack vectors, professional execution, zero protection from traditional email security.
One email came from kirill.lobachev@biology.gatech.edu (Georgia Tech) claiming to be from UC Berkeley's "Office of Student-Faculty Relations." The malicious URLs used fake paths designed to look legitimate: kirill.lobachev@biology.gatech.edu
UC Berkeley's security office noted these campaigns "create fear and urgency to bypass security awareness." When you combine urgency with a QR code users can't preview, you've eliminated every traditional defense mechanism.
Users shouldn't have to be security experts.
Your email security should catch this before it reaches them.
The fundamental problem, Legacy email security was built for text-based threats.
Image-based phishing (which includes Quishing), screenshots of fake invoices, and logos with embedded malicious content bypasses traditional detection methods because there's minimal or no text to analyze.
According to Osterman Research, 75.8% of organizations have been compromised by image-based and QR code phishing attacks over the past 12 months. Only 5.5% of organizations successfully detected and blocked all such attacks from reaching inboxes.
Why the gap?
Traditional Secure Email Gateways rely on pattern matching, keyword detection, and link reputation checks. Modern AI-based solutions add Natural Language Processing (NLP) to understand context and intent. But when the malicious content is embedded in an image, both approaches fail:
Across 1,921 organizations in the IRONSCALES customer base, 0.7% of missed phishing attacks were QR-code/image-based. That might sound small, but consider this
Stopping image-based attacks requires a fundamentally different approach:
1. Computer vision and image analysis
2. Sender intent and behavioral analysis
3. Domain and URL threat intelligence
/auth.berkeley.edu appended to malicious domains)This isn't a feature you can bolt onto legacy architecture. It requires AI-driven detection built from the ground up to analyze visual threats, not just textual ones.
IRONSCALES detects image-based threats before delivery using:
/auth.berkeley.edu URLsWhen just one staff member or student reports a QR code attack, we remove it (and future versions of it) from all affected mailboxes automatically. That's the difference between detection and defense.
Users need to know:
Include QR code scenarios in your phishing simulations. Make them realistic, fake parking permits, class or event registrations, "urgent" IT notifications.
But remember...even well-trained users make mistakes under stress. Your security needs to catch what they miss.
Your 3-person IT team can't watch 10,000 inboxes. But 10,000 users can watch for threats (if you give them the tools).
There's a bigger picture here. QR code phishing is just one example of a much larger threat evolution, image-based phishing attacks.
Attackers have figured out that if you can't read the text, you can't detect the threat.
Did I hear you ask "What are image-based attacks?"
I gotcha. Simple, it any phishing or BEC attack email where the malicious content is embedded in an image rather than text, such as:
☐ Did you expect this QR code? Unsolicited = suspicious
☐ Does the sender match the organization? External domains claiming to be internal = fake ☐ Is there urgency or threats? "Act now or lose access" = verify first
☐ Can you verify another way? Call IT using the official number, not the one in the email
And when in doubt? Report it
UC Berkeley's guidance: "Help Desks will NEVER initiate contact via text to personal cell phone numbers. No technician will EVER ask for passwords, DUO push codes, or credentials via text."
Want to see how IRONSCALES can protect your staff, faculty, and students from QR code phishing (and all the other types of email attacks)? Check out our K-12 and Higher Ed solution page to learn more here, or just give us a shout, we are happy to answer your questions and give you a demo.