Phishing, Quishing & Malicious Links: How to Stay Protected in 2026
Posted On: 25 Aug 2026
Phishing has been one of the most persistent cybersecurity threats for years, but in 2026, it is becoming harder to recognize and easier for cybercriminals to scale. The familiar suspicious email filled with spelling mistakes is no longer the only threat users need to watch for. Modern phishing attacks can arrive through emails, text messages, social media, messaging apps, fake websites, QR codes, and carefully disguised malicious links. Artificial intelligence is also helping attackers create more convincing messages and adapt established social-engineering techniques to new platforms and user behaviors. At the same time, QR code phishing, commonly known as quishing, has reached record levels. ESET’s H1 2026 Threat Report found that QR codes appeared in approximately 11% of detected phishing emails, with its telemetry averaging around 100,000 QR-code phishing detections per month. As online scams become more polished, knowing how phishing works and adopting multiple layers of protection can make the difference between safely ignoring an attack and unknowingly handing sensitive information to a cybercriminal.
Phishing is a form of social engineering in which cybercriminals impersonate a trusted person, company, service, or organization to convince someone to take an unsafe action. The attacker may send an email claiming there is a problem with your bank account, a text saying a package could not be delivered, or a message asking you to urgently reset a password. The objective is usually to create enough trust, fear, curiosity, or urgency that you click a malicious link, open an infected attachment, reveal login credentials, approve an authentication request, or make a payment. What makes phishing particularly dangerous is that it attacks people as much as technology. A malicious website can be designed to look almost identical to a legitimate login page, while a phishing message can imitate the tone and branding of a company you recognize. In 2026, users should therefore evaluate not only whether a message looks legitimate, but also whether the request itself makes sense and whether the destination is trustworthy.
Quishing, or QR code phishing, uses malicious QR codes instead of—or alongside—traditional clickable links. An attacker may place a QR code inside an email, document, poster, payment request, message, or other digital content and encourage the recipient to scan it. Once scanned, the QR code can direct the user to a phishing website or another potentially harmful destination. This technique creates a particular challenge because users cannot immediately see the destination URL simply by looking at the QR code. It may also move the interaction from a protected work computer to a personal or mobile device. According to ESET’s H1 2026 data, quishing reached record levels, with QR codes appearing in around 11% of detected phishing emails. Researchers have observed QR-based attacks being used for credential theft and malware delivery as well as attempts to capture authentication tokens, facilitate fraudulent payments, and direct users toward malicious apps or services. The convenience and familiarity of QR codes are precisely what attackers can exploit, making it increasingly important to treat an unfamiliar QR code with the same caution as an unfamiliar link.
Artificial intelligence is changing the phishing landscape because it can make social-engineering campaigns easier to create, personalize, and scale. Attackers no longer need exceptional writing skills to produce professional-looking messages. AI tools can assist with creating natural-sounding emails, adapting language and tone, generating convincing explanations, and producing content that more closely resembles legitimate communication. The broader threat landscape is also showing how attackers are adapting familiar techniques to AI-related environments. ESET reported that ClickFix detections grew 108% between H2 2025 and H1 2026, while newer variants such as AI-fix exploit users’ trust in AI-generated troubleshooting content. This evolution highlights an important shift in online safety: poor grammar and awkward wording are no longer reliable indicators of a scam. A phishing email may look professional, personalized, and completely believable. Instead, users increasingly need to look at context, sender details, URLs, unusual requests, and verification methods before deciding whether to trust a message.
Malicious links remain one of the simplest ways for attackers to direct users toward dangerous online destinations. A link can appear in an email, text message, social media post, online advertisement, document, QR code, or chat conversation. The visible text may look legitimate even though the underlying URL leads somewhere completely different. Once clicked, a malicious link may direct the user to a fake login page designed to steal credentials, a fraudulent payment page, or a site attempting to deliver malware. Attackers may also use URL shorteners, lookalike domains, misleading subdomains, and subtle spelling changes to make suspicious links harder to recognize. This is why users should avoid assuming that a familiar logo or professional-looking page proves a website is genuine. Before entering passwords, payment information, or personal details, check the website address carefully. When possible, open important services through a trusted bookmark, official app, or manually entered website address rather than following an unexpected link.
Spotting phishing is becoming more difficult, but there are still warning signs worth watching. Be cautious when a message creates unnecessary urgency, claims your account will immediately be suspended, offers an unexpected reward, requests sensitive information, or pressures you to act without verifying the situation. Unexpected attachments should also be treated carefully, especially when they ask you to enable editing, enable content, install software, or enter a password. ESET notes that malicious documents are frequently disguised as invoices, HR documents, tax forms, or delivery notifications, while warning signs can include unusual file types and unexpected requests to enable content. However, no single warning sign is enough. A sophisticated phishing message may contain correct branding, proper grammar, a familiar sender name, and information that seems relevant to you. The safer approach is to independently verify unusual requests through a trusted communication channel rather than relying solely on how convincing the message appears.
QR codes deserve the same level of caution as clickable links. Avoid automatically scanning a QR code simply because it appears in a professional-looking email or document. Before opening the destination, check whether your phone displays a URL preview and examine the domain carefully. Be particularly cautious if scanning a QR code immediately leads to a login page, payment request, software download, or request for sensitive personal information. If the QR code supposedly comes from your bank, employer, delivery provider, or another important service, consider opening the organization’s official app or website independently instead. Businesses should also consider security technologies capable of identifying QR codes and analyzing the URLs contained within them. ESET, for example, describes an email-scanning approach that detects QR codes, extracts their URLs, and analyzes those destinations using anti-phishing, anti-malware, and anti-spam technologies. The important principle is simple: scan with caution, verify the destination, and do not let the convenience of a QR code override normal security checks.
As phishing attacks become more sophisticated, technology can provide an additional layer of protection when human judgment is not enough. URL scanning tools can help analyze suspicious links and identify potentially malicious destinations before users visit them. Threat scanning, antivirus protection, browser security features, spam filtering, and anti-phishing technologies can also help identify known malicious content and suspicious behavior. This is especially useful because a dangerous link does not always look dangerous. A website may closely imitate a trusted brand, while the malicious destination could be hidden behind a shortened URL or QR code. Security tools should not be treated as a guarantee that every attack will be stopped, but they can reduce exposure and provide additional opportunities to detect suspicious activity. The strongest approach combines technology with careful user behavior rather than relying exclusively on either one.
For organizations, phishing presents an even greater challenge because one successful interaction can potentially expose business accounts, customer information, cloud services, or internal systems. Attackers may target employees with fake login pages, invoices, document-sharing notifications, QR codes, or requests that appear to come from executives and colleagues. Some newer social-engineering techniques are also moving beyond straightforward password theft. ESET’s 2026 research describes ConsentFix, for example, as combining ClickFix-style interaction with OAuth authorization abuse to hijack cloud accounts without necessarily stealing credentials and potentially bypassing traditional MFA protections. Businesses therefore need a layered defense that includes email security, endpoint protection, URL filtering, strong authentication, access controls, employee awareness training, and procedures for independently verifying unusual requests. Employees should also have an easy way to report suspicious emails, links, and QR codes so security teams can investigate potential campaigns quickly.
Good cybersecurity habits remain one of the most effective defenses against phishing. Avoid clicking unexpected links, even when they appear to come from a familiar organization. Check URLs before entering credentials and independently visit official websites when dealing with account warnings, payment requests, or password resets. Treat unfamiliar QR codes with caution and preview their destinations whenever possible. Use unique passwords for important accounts and enable multi-factor authentication, while remembering that sophisticated attacks may also attempt to trick users into approving authentication requests or authorization flows. Keep your browser, operating system, applications, antivirus, and other security software updated so known vulnerabilities and threats can be addressed quickly. Most importantly, slow down when a message tries to create urgency. Phishing succeeds when an attacker convinces someone to act before thinking, checking, or verifying.
Phishing in 2026 is no longer limited to suspicious emails and obvious fake websites. Cybercriminals are adapting to the way people communicate, work, shop, scan QR codes, and use AI-powered services. Quishing has reached record levels in ESET’s telemetry, malicious links continue to provide attackers with a direct route to potential victims, and AI-assisted techniques can make fraudulent content increasingly convincing. The answer is not to distrust everything online, but to develop better verification habits and use security technologies that provide additional layers of defense. Think before clicking, check before scanning, verify unexpected requests, and use threat detection and URL scanning where appropriate. A few seconds spent checking a link or QR code can prevent a much larger security problem.
Phishing is a cyberattack that uses deceptive emails, messages, websites, or links to trick users into revealing sensitive information or taking unsafe actions. Avoid unexpected links and attachments, verify unusual requests independently, use strong authentication, and keep security software updated.
Quishing is a phishing attack that uses a QR code to direct users to potentially malicious websites or other destinations. Always preview and check the destination before opening a QR code link, particularly when it requests login, payment, or personal information.
Check for misspelled domains, unusual URLs, suspicious redirects, unexpected shortened links, and websites requesting sensitive information without a clear reason. A reputable URL scanner or security solution can provide an additional check before visiting an unfamiliar link.
AI can help attackers create polished, natural-sounding and potentially more personalized phishing content at scale. This makes traditional clues such as spelling mistakes less dependable, so verifying senders, links, destinations, and unusual requests is increasingly important.
Avoid entering any information or downloading files and close the page. If you entered a password, change it immediately from the legitimate service and review the account for suspicious activity. Run an appropriate security scan, and if the incident involves a workplace account or device, report it promptly to your IT or security team.
