Fake QR codes on event posters are now a documented phishing tactic: attackers take a genuine poster, put their own QR code on it, and send it to people likely to attend. Cisco Talos described exactly this in a report published in October 2026, and it is a useful warning for anyone who prints a code to promote a conference, talk or workshop.
What Cisco Talos reported
On 8 October 2026, researcher Joey Chen of Cisco Talos published an analysis of a campaign it tracks as UAT-11985, titled as AI-assisted event lures delivering real-time Google phishing. According to Talos, the targets were people affiliated with research organisations in Taiwan, and the emails impersonated three bodies: the Taiwan European Union Centre, an international relations institute at NCCU, and the Taiwan Research Institute. Talos said none of those organisations could confirm that the senders were their employees or representatives.
The detail that matters for event organisers is the lure itself. Talos says legitimate event posters were modified so that they carried malicious QR codes. Someone who scanned one was sent to a fake Google sign-in page, available in Simplified Chinese, Traditional Chinese and English. Talos describes the kit as relaying credentials and multi-factor challenges in real time, with the aim of taking over the account entirely.
Talos also said it could not conclusively determine whether a language model wrote the emails, although it saw strong evidence of AI-assisted content. It assessed with moderate confidence that the developer's main working language is Simplified Chinese. Those are Talos's assessments rather than established facts, and the report gives no victim counts or financial figures, so we are not offering any.
Why fake QR codes on event posters work
An event poster is a trusted object. It carries a real name, a real venue and a real date, and people expect to scan it to register or see the programme. Altering a copy takes minutes, and a QR code gives the reader no clue about where it leads. The attacker does not need to break into anything: they only need a believable image and a list of likely attendees.
This is a close relative of the sticker scams we covered in fake QR code stickers on parking meters, except that here the overlay is digital. For the wider picture of how QR codes get abused, see are QR codes safe?
What a QR platform cannot do
We make one of the tools this article is about, so here is the limit stated plainly. The malicious code in a campaign like this is not created on your account, and it does not point through your links. If an attacker edits a copy of your poster, no dashboard setting can reach it. Software cannot stop a PDF or image being copied, edited and emailed, and it cannot remove a sticker from a wall either.
Anyone who tells you a QR generator makes you immune to this kind of impersonation is overselling. The realistic goal is smaller: make your genuine codes easy to verify, and notice trouble sooner.
What event organisers can do about fake QR codes on event posters
Give people something to check
A code that opens on your own address shows your name in the preview a phone displays. A custom domain for your QR codes lets an attendee compare the address with your official site before they trust it. Custom domains are a Pro feature.
Print the address in words
Put a short web address next to the code so people can type it and skip the scan. If the poster says the official page is on your domain and nothing else, a lookalike has a harder time passing.
Say how you communicate
Tell attendees where official posters appear and that you never ask for a Google or Microsoft sign-in to register. Attackers rely on urgency and plausibility, so a plain sentence on your site about what you will never ask for is cheap protection.
Use one code per channel
Separate codes for the venue poster, the email and the social post let you see which channel is working. A dynamic QR code can also be paused or re-pointed in seconds for every printed copy, so if you spot a problem with your own genuine code you do not need a reprint. Optional per-code controls include a password, an expiry date and country restriction.
Watch your scan logs
QR code tracking records each scan with its country, city and device, and bot filtering keeps link previews and crawlers out of the numbers. A genuine code that suddenly gets scans from an unexpected country, or none at all while attendance is unchanged, is a prompt to investigate. It is a hint rather than proof, and a fake code on someone else's link will never appear in your logs. Scan alerts and webhooks, which can notify you automatically, are available on the Pro plan.
Protect the sign-in step, not just the code
The real damage in the Talos case came from stolen account access. Organisers who collect registrations can reduce the temptation to ask for sign-ins at all. A simple registration or feedback form behind a code, as described in our guide to QR code forms, never needs anyone's Google password. For ticketed events, ticket and voucher validation lets staff check passes at the door on any phone.
What attendees should do
- Treat an unexpected poster as unverified. If it arrived by email, especially from someone you do not know, go to the organiser's website directly.
- Read the address your phone shows. It should match the organiser's official domain.
- Be suspicious of any sign-in prompt reached from a poster. Registration rarely needs your email password.
- Use a password manager or passkeys. A password manager will not autofill on a lookalike domain, which is a useful warning in itself.
The takeaway
The Talos report is about targeted spear-phishing, not a mass scam, and the reported targets were a narrow group. But the technique transfers easily to any organiser whose poster is public. You cannot stop a copy being altered, so the aim is to make your real code verifiable and your channels predictable. For a fuller plan, read our complete playbook for QR codes at events and see how QR codes for events work on our platform.