Researchers at Trustwave are tracking an increase in the use of QR codes to spread phishing links.
“Being open-source, QR code generators have become accessible to anyone with access to the internet,” the researchers write. “The increased availability and flexibility of QR codes makes them the perfect tools for cybercriminals to further disguise their malicious links and evade anti-spam filters.”
The QR codes often arrive in the form of phony multi-factor authentication emails.
“The samples we have observed using this technique are primarily disguised as Multi-factor Authentication (MFA) notifications, which lure their victims into scanning the QR code with their mobile phones to gain access,” the researchers write. “However, instead of going to the target’s desired location, the QR code leads them to the threat actor’s phishing page. Some samples go even further by targeting specific organizations with personalized templates. These contain the victim organization’s logo making it look more legitimate.”
Attackers are also using Bing search result links and PDF files to disguise the QR code phishing links, in an attempt to evade technical defenses.
“The abuse of Bing search result links is also added to the mix as an additional evasion technique, and PDF attachments are also used to hide the QR codes making them less obvious,” the researchers write. “Publicly available APIs also can be used to generate phishing QR codes on the fly. These techniques come together to lure unsuspecting victims into scanning the phishing QR code with their mobile phone which may bypass corporate security mechanisms and could pose a serious security threat for organizations.”
The researchers conclude that organizations should use a combination of technical defenses and employee training to defend against these threats.
“Raising awareness is key to protecting ourselves from these threats,” Trustwave says. “Organizations should advocate training staff members to be more vigilant when inspecting unexpected emails, in addition to applying strong security measures to protect their network.”
New-school security awareness training can give your organization an essential layer of defense by teaching your employees to recognize evolving social engineering tactics.
Trustwave has the story.
