What quishing is
Quishing is phishing delivered through a QR Code. The victim scans the code with their phone, often a device outside the company’s security controls, and lands on the page. qlture offers two modes:
| Mode | How it’s delivered | Tracking |
|---|---|---|
| QR in email | QR embedded in the email body | Per target (individual) |
| QR poster | Printed physical poster, put up in common areas | Anonymous (collective) |
Mode 1 — QR in email
Pick the Email + QR (quishing) vector at the top of the editor. In the email body, use the {{qrcode}} placeholder:
Scan the code below to validate your account:
{{qrcode}}
The platform generates a QR Code PNG per target, pointing to the individual trackable link, and embeds it in the email. Scanning it on a phone is equivalent to clicking — the event is attributed to that person.
The bait is valid as long as the body contains the link placeholder OR the QR Code placeholder. You can use both in the same email.
Mode 2 — QR poster
The poster is meant to be put up in common areas like the break room, the elevator, or a bulletin board, testing collective curiosity. Pick the QR poster (physical) vector. Differences from email:
- No targets and no sending. No email goes out; you print and put up the poster.
- One token per campaign. Since anyone can scan it, there’s no way to know who did: tracking is anonymous and collective.
- Scan count. Each read increments the campaign’s total scans, shown in the results.
Generate the PDF
The poster has its own panel (outside the 4-step wizard). You configure:
- The poster’s headline and subtext.
- And you download a printable A4 PDF, ready to print.
Activate the campaign under Publish poster — this puts the campaign “live” and generates the QR token. From that point on, every scan is counted.
Results
- QR in email: the same funnel as email campaigns (sent, opened, clicked via scan, reported), tracked per target.
- Poster: an anonymous scans card, with the total reads over the campaign.
Related
- Phishing simulation — overview and campaign steps.
- Smishing — bait over SMS.
