Phishing Attacks Employing QR Codes Are Capturing User Credentials

QR Code PhishingUsing a new twist to bypass detection from security solutions, cyber attacks are now employing QR codes that your users will not recognize as anything suspicious.

Threat actors need some means of getting a user to engage with malicious content – whether an attachment, link, or phone call, there needs to be some content within an email that provides the victim user with their next step.

Right behind this are the security solutions which have employed scanning those attachments, following the links to their end, etc. in an attempt to provide the user and their organization with a first layer of defense to stop such attacks before they start.

A new phishing attack method spotted by security researchers at Inky includes the use of a QR code, prompting a victim user to take a picture of the image and navigate to the resulting impersonated login page.


Source: Inky

It’s insidious for a number of reasons, two of which are obvious immediately:

  • I’m not aware of any security solution that can follow a QR code-based URL to determine if the resulting URL is malicious or not.
  • It shifts the actual threat action to another device – specifically one that has far less protections than a user’s endpoint.

But it’s also awkward, because who takes a picture of a QR code to login to their email, etc. instead of just clicking a link. Despite this lack of reasoning as to why this should work, we see that this type of social engineering works anyway, otherwise the cybercriminals wouldn't be using this method.

This kind of attack highlights the fact that your users need to be continually educated through Security Awareness Training that anything out of the ordinary – especially something this wacky just to log onto a website – should be avoided.

Free QR Code Phishing Security Test

Did you know dynamic QR code scans increased 433% globally from 2021 to 2022? Try our free QR Code Phishing Security Test to identify users that are most susceptible to these types of attacks so you can train them to think twice before scanning QR codes and build a stronger security culture.

Monitor-QRT-2Here's how it works:

  • Immediately start your test for up to 100 users (no need to talk to a person)
  • Select from 35 languages and choose one of 3 templates
  • Choose from a “red flags missed” or a “404 error” landing page
  • Get a PDF emailed to you in 24 hours with your Phish-prone Percentage

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews