Phishing Attacks Employing QR Codes Are Capturing User Credentials

Using a new twist to bypass detection from security solutions, cyber attacks are now employing QR codes that your users will not recognize as anything suspicious.

Threat actors need some means of getting a user to engage with malicious content – whether an attachment, link, or phone call, there needs to be some content within an email that provides the victim user with their next step.

Right behind this are the security solutions which have employed scanning those attachments, following the links to their end, etc. in an attempt to provide the user and their organization with a first layer of defense to stop such attacks before they start.

A new phishing attack method spotted by security researchers at Inky includes the use of a QR code, prompting a victim user to take a picture of the image and navigate to the resulting impersonated login page.

Source: Inky

It’s insidious for a number of reasons, two of which are obvious immediately:

• I’m not aware of any security solution that can follow a QR code-based URL to determine if the resulting URL is malicious or not.
• It shifts the actual threat action to another device – specifically one that has far less protections than a user’s endpoint.

But it’s also awkward, because who takes a picture of a QR code to login to their email, etc. instead of just clicking a link. Despite this lack of reasoning as to why this should work, we see that this type of social engineering works anyway, otherwise the cybercriminals wouldn't be using this method.

This kind of attack highlights the fact that your users need to be continually educated through Security Awareness Training that anything out of the ordinary – especially something this wacky just to log onto a website – should be avoided.