Quishing: An increasing new threat that exploits QR codes

Quishing is a new and growing cybercrime threat that takes advantage of the widespread utilisation of QR codes in phishing attempts.

These QR codes, which can be easily scanned by people who can be potential targets through smartphones, are usually considered harmless and have become a trending tool for businesses and organisations to exchange information, make payments, and direct consumers to websites. Exploiting trust and familiarity is a typical approach in some activities.

Scammers can use QR codes in various ways, including emails, text messages, social media, public venues, and even directly contacting people to scan them.

Law enforcement agencies and researchers have noticed an upsurge in scammers encouraging victims to use actual crypto ATMs and QR codes to make payments.

Fraudsters frequently trick victims into making payments and prompt them to withdraw money from their financial accounts, such as investment or retirement accounts.

The FBI warns that the potential victim will be handed a QR code linked to the scammer’s Bitcoin wallet to use during the transaction.

The fraudster can then redirect the target to an actual Bitcoin ATM, where they may deposit monetary funds, buy crypto, and use the provided QR code to fill in the recipient’s address automatically.

 

Quishing campaigns follow a method that revolves around tricking a target.

 

Cybercriminals construct QR codes that, when scanned, take consumers to fake websites or start the download of malicious software.

QR codes can be transmitted in various ways, including emails, social media, printed materials, and stickers pasted over authentic QR codes in public places.

When someone scans the QR code, they are taken to a bogus website that may appear authentic. This website will then ask them to provide sensitive information such as account credentials, personal information, or financial information.

Malware may be downloaded in response to particular quishing efforts, which can compromise devices and networks.

The attackers used hacked email accounts to deliver QR codes over the victim organisation’s genuine Outlook infrastructure. The phishing pages discovered following QR code scans were hosted by an enterprise survey provider and related to IP addresses associated with Google or Amazon.

What distinguishes these messages is the inclusion of QR codes that enable users to view missed voicemails. This process cleverly avoids the need to scan URLs for email attachments, which most secure email gateways and native security mechanisms block.

Most of the QR code pictures were generated on the same day they were sent, reducing the likelihood of them being recognised by a security blocklist owing to previous reports. A total of six separate profiles were used to send messages for the campaign, with the majority designed to appear related to the industry of interest.

 

Recent Quishing Attacks

In recent phishing efforts, fraudsters have begun to lead victims to bogus websites using QR codes rather than buttons. These emails obscure URLs with QR codes, making identifying them challenging and complex for security software.

QR codes have become more effective by focusing on mobile users, who may have less protection from internet security technologies.

When people visit the phishing site, they must enter their bank’s location, code, username, and PIN. After entering these details on the phishing website, the user waits patiently for validation, only to be forced to re-enter their credentials since they were incorrect.

This technique is commonly used in phishing attempts to avoid typos when visitors enter their credentials for the first time.

It is critical to be cautious while interacting with emails, even if they appear legitimate. Avoid clicking buttons, URLs, or QR codes that take you to another website. Before entering your account information, you should validate your domain to ensure its legitimacy.

You may have seen them in various places, including restaurants, parking lots, and marketing efforts. In 2022, the FBI raised the issue of fraudsters using QR codes to gain victims’ bank information illegally.

Historically, QR Code phishing scams were uncommon. However, around mid-September 2023, researchers and authorities detected a significant increase in QR code phishing attempts.

Recent quishing (QR code phishing) demonstrates fraudsters’ ever-changing techniques and the growing significance of exercising extreme vigilance when it comes to digital security.