Malicious QR codes drive surge in global cybercrime, APWG warns

QR codes, once a symbol of convenience, now serve as powerful tools for phishing and malware, according to APWG’s Q1 2025 threat report.

The latest report from the Anti-Phishing Working Group (APWG) reveals a chilling evolution in cybercrime tactics, one that leverages a common convenience into a global vector for malicious attacks: the QR code.

According to the APWG’s Q1 2025 Phishing Activity Trends Report, cybercriminals have embraced QR codes at an unprecedented scale, using them to bypass traditional defenses and lure users into phishing traps and malware-laden websites.

QR codes: A wolf in a friendly square

Originally a convenience for contactless menus and app downloads, QR codes have become a potent cyber weapon. Mimecast, an APWG member, detected over 1.7 million unique malicious QR codes in emails processed between October 2024 and March 2025. During this period, 2.7 million QR code-laden emails hit inboxes daily.

QR codes are especially appealing to cybercriminals because they often evade traditional email filters. Designed to appear benign, frequently mimicking banks, retailers, or government services, these codes lull users into scanning them, unknowingly landing on phishing sites or malware delivery pages.

AI-powered marketing’s unintended consequence

The explosive growth of AI in marketing has played an unexpected role in the QR threat surge. Marketers increasingly rely on AI-driven tools to deliver personalized experiences through automated email campaigns, dynamic landing pages, and QR-based promotions.

QR codes, once static, are now dynamically generated, geo-targeted, and embedded in AI-personalized campaigns. These innovations offer powerful engagement but also expand the attack surface for cybercriminals.

“Cybercriminals are mimicking the precision of AI-powered marketing,” said a threat analyst at APWG. “They’re using QR codes that look and behave like legitimate brand assets, making detection by both users and filters incredibly difficult.”

As marketers embrace machine learning for campaign optimization...