QR Code Phishing Campaigns on the Rise

QR Code QishingThere’s been a “precipitous rise” in QR code phishing  campaigns in 2023, according to Matthew Tyson at CSO.

“For the attacker, QR codes bring a number of benefits, including some appreciated by legitimate businesses: they are easy to create and easy to use,” Tyson writes. “It is easy for attackers to use free resources to generate convincing QR code enabled phishing emails, attachments, and websites — a mechanism that can increase the effectiveness of their efforts with minimum effort.”

Olesia Klevchuk, director of email protection at Barracuda, told CSO that QR codes are more difficult for security defenses to detect.

“URL scanning and URL rewrite technologies are ineffective against QR code attacks because there is simply no link to scan,” Klevchuk said. “Because users have to scan QR codes with their phones, it basically moves these attacks to an entirely new device that is often outside of the company's security.”

Tyson says organizations should implement the following layers of defense to help thwart QR code phishing attacks:

  • Education: Ensure users are aware of the quishing trend and emphasize that QR codes are not an indication of legitimacy."
  • Prevention: Automated systems that filter emails and URLs should be examined and hardened against QR codes. Existing use of QR codes by the enterprise should be examined to make it as hard as possible for attackers to hijack them."
  • Response: Detection and lockout mechanisms should be in place to protect against account compromise."
  • Validation: Incorporate QR code attacks red teaming tests and attack simulations.”

Tyson adds, “As technology-oriented professionals, we work towards a technology-oriented solution, but education and awareness play their part. We've gotten used to harping on the distrust of emails and confirming through a second channel anything significant. QR code attacks adds an important element: QR codes are not any kind of indication of legitimacy.”

KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

CSO has the story.

Free QR Code Phishing Security Test

Did you know dynamic QR code scans increased 433% globally from 2021 to 2022? Try our free QR Code Phishing Security Test to identify users that are most susceptible to these types of attacks so you can train them to think twice before scanning QR codes and build a stronger security culture.

Monitor-QRT-2Here's how it works:

  • Immediately start your test for up to 100 users (no need to talk to a person)
  • Select from 35 languages and choose one of 3 templates
  • Choose from a “red flags missed” or a “404 error” landing page
  • Get a PDF emailed to you in 24 hours with your Phish-prone Percentage

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe to Our Blog

Comprehensive Anti-Phishing Guide

Get the latest about social engineering

Subscribe to CyberheistNews