<\/p>\n
<\/p>\n
<\/p>\n
CMIT Solutions of Las Vegas<\/strong> \u00a0\u00b7\u00a0 Cybersecurity \u00a0\u00b7\u00a0 June 28, 2026<\/p>\n <\/p>\n You scan the QR code on the table at a Strip restaurant. Or the one on the parking kiosk near your office. Or the \u201cscan to check in\u201d sign at a vendor conference at the Convention Center. In Las Vegas, QR codes are everywhere<\/em> \u2014 and that is exactly why cybercriminals are using them to attack Clark County businesses right now.<\/p>\n The attack is called \u201cquishing\u201d<\/strong> \u2014 a portmanteau of QR code<\/em> and phishing<\/em>. It works because a QR code is just an image. Your email security gateway scans for malicious links in text. It cannot read what is encoded inside a picture. Attackers figured this out and ran with it: QR code phishing campaigns increased 2,400% between May and August 2023<\/strong> alone, according to researchers at Malwarebytes \u2014 and the numbers have continued climbing every quarter since.<\/p>\n This is not a future threat. It is happening to Las Vegas hospitality vendors, law firms, healthcare practices, and construction companies right now. Here is what the attack looks like, why Las Vegas is a prime target, and three specific steps every Clark County SMB should take this week.<\/p>\n <\/p>\n The mechanics are simple, which is why they are so effective. An attacker sends an email \u2014 often disguised as an HR benefits update, a Microsoft 365 security alert, or a vendor invoice \u2014 with a QR code embedded as an image instead of a clickable link.<\/p>\n Your email security gateway scans the message. It sees no suspicious URLs, no known malware signatures, no dangerous attachments. The email lands in the inbox marked clean. The employee, scanning the QR code with their personal smartphone to \u201cverify their account\u201d or \u201ccomplete an HR action,\u201d is taken to a credential-harvesting page that looks identical to Microsoft, Google, or your line-of-business application.<\/p>\n <\/p>\n Researchers at Cofense documented one campaign targeting a major U.S. energy company in which more than 1,000 malicious emails containing QR codes were sent in a single wave. The financial services sector, manufacturing, insurance, and technology companies have all been hit at scale. Healthcare is increasingly in the crosshairs \u2014 and in Las Vegas, so is hospitality.<\/p>\n <\/p>\n Most cities have QR codes. Las Vegas has them on everything<\/em>. Post-pandemic, the hospitality industry adopted QR menus, QR check-in, QR tipping, and QR event registration at a pace unmatched in North America. The Strip and downtown properties run conventions, trade shows, and entertainment events that generate millions of QR scans per year.<\/p>\n This normalized behavior \u2014 employees and guests scanning QR codes dozens of times a day without thinking twice \u2014 is exactly the cultural condition attackers exploit. When a QR code in an email looks just like the QR code on the conference badge or the hotel room service menu, the psychological guard drops.<\/p>\n <\/p>\n \u25ba<\/span><\/p>\n \u25ba<\/span><\/p>\n \u25ba<\/span><\/p>\n \u25ba<\/span><\/p>\n \u25ba<\/span><\/p>\n There is an additional compounding factor unique to Las Vegas: the workforce. Many employees in Clark County\u2019s hospitality economy work across multiple properties and vendors, using personal smartphones rather than managed corporate devices. When a quishing attack lands on a personal phone, it bypasses every endpoint protection control your IT team has deployed on company hardware.<\/p>\n <\/p>\n Secure email gateways (SEGs) \u2014 tools like Microsoft Defender, Proofpoint, and Mimecast \u2014 are excellent at scanning links in email bodies. They follow URLs, detonate attachments in sandboxes, and check sender reputation. What they cannot do reliably is decode the content of every QR code image in every email.<\/p>\n Attackers exploit this in layers. First, they encode the malicious URL inside the QR image so there is no text link to scan. Then they wrap the QR image in a PNG or PDF attachment, adding another layer of obfuscation. Finally, they use legitimate redirect services \u2014 Bing redirect URLs, Salesforce links, Cloudflare Web3 domains \u2014 so even if the gateway does<\/em> attempt to follow the URL, it hits a trusted domain first before being redirected to the credential harvesting page.<\/p>\n <\/p>\n \u201cBy concealing the phishing link within the QR image, attackers achieve a higher likelihood of evading email filters and reaching the recipient\u2019s inbox. The QR image is then further embedded within a PNG or PDF attachment, adding an additional layer of deception.\u201d<\/p>\n The result: a technically clean email, delivered to the inbox, with a payload that executes entirely on a personal mobile device that your gateway has never seen and cannot protect. The attack is designed specifically to fall through the gaps in traditional perimeter security.<\/p>\n <\/p>\n <\/p>\n Your current security awareness training almost certainly covers email phishing, password hygiene, and social engineering. It almost certainly does not<\/em> cover quishing as a named, specific threat. Update your training to include a simple rule: never scan a QR code in an email on a personal device without first confirming the sender through a separate channel.<\/strong> Run a simulated quishing exercise against your team \u2014 you will be surprised how many scans it generates. CMIT Solutions includes QR code phishing simulations as part of our managed security awareness training for Las Vegas businesses.<\/p>\n<\/div>\n<\/div>\n<\/div>\n <\/p>\n Quishing\u2019s primary goal is credential theft. If an attacker harvests your employee\u2019s Microsoft 365 login, multi-factor authentication (MFA) is the last line of defense that prevents that stolen credential from becoming a full network compromise.<\/strong> Enforce MFA on every user account, every application, every remote access point \u2014 with no exceptions for executives or \u201cpower users\u201d who find it inconvenient. Phishing-resistant MFA (FIDO2\/passkeys) is the gold standard; at minimum, use an authenticator app rather than SMS codes, which are vulnerable to SIM-swap attacks. CMIT Las Vegas can audit and enforce your MFA posture across your entire environment within days.<\/p>\n<\/div>\n<\/div>\n<\/div>\n <\/p>\n Quishing attacks land on personal phones. If your employees access company email, Microsoft Teams, or any business application on their personal device \u2014 and in Las Vegas hospitality and construction, most of them do \u2014 that device is part of your attack surface whether you manage it or not. Deploy a Mobile Device Management (MDM) or Mobile Application Management (MAM) policy that enforces minimum security standards on any device that touches your corporate data.<\/strong> At minimum: conditional access policies that block sign-in from devices that lack a screen lock, encryption, and current OS patches. CMIT Solutions can implement this through Microsoft Intune or your existing MDM platform without requiring a full corporate device enrollment.<\/p>\n<\/div>\n<\/div>\n<\/div>\n <\/p>\n Quishing requires a layered defense because a single tool cannot stop it. Our managed cybersecurity stack for Clark County businesses addresses every layer of the attack chain:<\/p>\n \u25a0<\/span><\/p>\n \u25a0<\/span><\/p>\n \u25a0<\/span><\/p>\n \u25a0<\/span><\/p>\n \u25a0<\/span><\/p>\n <\/p>\n QR codes are not going away in Las Vegas \u2014 they are too woven into how hospitality, events, and business operations run here. That means quishing is not a passing threat you can wait out. It is a permanent part of the attack surface every Clark County business needs to manage.<\/p>\n The businesses that get hit are the ones whose employees have never been told that scanning a QR code in an email on a personal phone is a security event \u2014 not a routine task. Three controls change that equation: training, MFA enforcement, and mobile device policy. All three can be deployed by a managed IT services provider in days, not months.<\/p>\n <\/p>\n CMIT Solutions of Las Vegas offers a free cybersecurity assessment for Clark County SMBs \u2014 including an audit of your email security, MFA posture, and mobile device exposure. No commitment. Just honest answers about where you stand.<\/p>\n 3111 S. Valley View Blvd., Suite A205, Las Vegas, NV 89102 \u00a0\u00b7\u00a0 LVsupport@cmitsolutions.com<\/p>\n<\/div>\n <\/p>\n QR code phishing \u2014 known as “quishing” \u2014 surged 2,400% and bypasses your email security gateway because the malicious URL is hidden inside an image. Las Vegas hospitality, healthcare, and professional services businesses are prime targets. Here’s what the attack looks like and three controls that stop it.<\/p>\n","protected":false},"author":1008,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1393","post","type-post","status-publish","format-standard","hentry","category-local-it"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tHow a Quishing Attack Works \u2014 Step by Step<\/h2>\n
Why Las Vegas Is Especially Exposed<\/h2>\n
Why Your Email Security Gateway Won\u2019t Stop This<\/h2>\n
Three Steps Every Las Vegas Business Should Take This Week<\/h2>\n
How CMIT Solutions of Las Vegas Protects Against Quishing<\/h2>\n
The Bottom Line for Las Vegas Businesses<\/h2>\n
\nGet a Free Security Assessment \u2192
\n<\/a>
\n
\n\u2706 (702) 725-2877
\n<\/a><\/div>\n
\n\u25ba \u201cClickFix\u201d Phishing: The Fake Browser Error Targeting Las Vegas Hospitality
\n<\/a>
\n
\n\u25ba Cybersecurity Services for Las Vegas Businesses \u2014 CMIT Solutions
\n<\/a><\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"