Phishing Series 2026: Quishing — QR-Code Phishing to New Domain + Fast Mobile Sign-In
This rule detects a multi-stage phishing attack, often referred to as 'quishing'. It identifies incoming emails containing image (JPG, PNG) or PDF attachments that embed previously unseen URLs, correlated with a subsequent sign-in event from a mobile device by the same recipient, which is a common indicator of Adversary-in-the-Middle (AiTM) credential harvesting.
Microsoft Sentinel (KQL)
