QR code phishing (quishing) detections in Mexico, first half of 2026, Digi Mart USA News: Mexico ranked among the three countries in the world with the most detections of quishing, a form of cyber fraud that uses QR codes, during the first half of 2026.
According to the ESET Threat Report H1 2026, prepared by ESET Latin America, Mexico accounted for 6% of global detections of this threat. The United States and Spain ranked higher, with 19% and 17% respectively.
Mexico also led regional detections of this method in Latin America.
Quishing combines the words QR and phishing. It is a social engineering technique in which cybercriminals hide a malicious address inside a QR code rather than displaying a visible link.
Unlike traditional phishing, where users can read and check an address before opening it, the destination of these codes remains hidden until they are scanned.
This feature allows attackers to shift the interaction to mobile phones, where they can direct victims to fake pages or prompt them to take actions within legitimate applications. The codes can arrive through digital channels such as emails, attached PDF files, WhatsApp or SMS messages, websites and social media profiles.
They can also be distributed physically through posters, flyers, papers placed on vehicle windshields, or stickers pasted over legitimate QR codes.
According to the study, QR codes appeared in about 11% of the phishing emails analyzed by the company globally during the same period, while QRCode/Phishing ranked seventh among the main threats distributed by email.
Jonathan Ramos, information security researcher at ESET Latin America, explained that this method changes the environment in which the deception occurs. “By asking the victim to scan a code, the cybercriminal moves the interaction from a relatively protected environment, such as a work computer, to a mobile phone that often does not have the same security measures,” he said.
One example of these campaigns detected by ESET during the semester involved impersonation of DocuSign, an electronic signature platform used by businesses and one of the brands most frequently used by attackers in phishing campaigns observed in Latin America during that period. The emails imitated a company notification stating that a document was ready for review and signature, but instead of a link they displayed a QR code that the recipient was required to scan to continue.
The message used DocuSign’s visual identity and featured a yellow button instructing the recipient to scan the code to review and complete the document, although the code did not lead to any site. Because the email contained little text and the destination address was hidden within the image, there were few signs that would help the user identify the deception before using their phone’s camera.
Once the code is scanned, criminals can direct victims to fake login pages for banks, email services or corporate applications to steal credentials or hijack sessions. The technique can also be used to open payment screens with preloaded data to facilitate fraudulent transactions, as well as to lead to sites from which malicious applications are downloaded outside official app stores.
