Treat anything you entered as compromised

    Reset the affected account, dispute any payment, and check the device that scanned it.

    JDCS
    By Jordan Dickson · Reviewed by CSG Security Engineers

    Updated June 2026 · 1 min read

    Quishing kits behave exactly like phishing kits — they forward credentials to the attacker in seconds. The recovery is the same: assume they have it, change it, kill the sessions.

    Check the scanning device too

      • iOS: Settings → General → VPN & Device Management for unknown profiles
      • Android: Settings → Apps for newly installed apps with broad permissions
      • Run a scan with Bitdefender, Malwarebytes or Sophos Mobile

    Was this guide helpful?

    Know someone who needs this? Send them the guide.

    JD

    Written by

    Jordan Dickson

    Founder, CyberSecurityGuides

    Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

    Reviewed by CSG Security Engineers

    More from Communications Security

    No image

    Verify the real person is safe

    Before anything else, confirm that your loved one is actually fine.

    No image

    Set up a family safe-word and warn the household

    A shared secret beats AI — set it up immediately so this can't happen again.

    No image

    Don't pay, don't reply, don't delete

    Capture the threat as evidence and isolate the conversation — don't engage further.