How Attackers Use QR Codes in Phishing Emails to Steal Credentials and Deliver Malware

Summary

Attackers use QR codes in phishing emails to direct victims to credential-stealing pages or malware on personal mobile devices, where enterprise protections may be weaker. Talos recommends mobile security, QR-code URL inspection, user education, and MFA.

Key points

Talos reported a rise in QR-code phishing in 2023 and handled a QR-code campaign during a fourth-quarter 2023 incident response engagement.
In reported attacks, scanning a code on a personal phone led to malware execution or fake Microsoft 365 login pages that stole credentials.
QR codes shift the attack from a protected work computer to a personal mobile device, where enterprise security tools may have less visibility and control.
Organizations can use mobile device management or other mobile security tools for personal devices that access business information.
Email security tools can extract URLs from QR codes and analyze them for malicious destinations.
Users should preview QR-code links, visit only recognized URLs, check for phishing red flags, and verify a code's legitimacy before sharing personal information.
Multi-factor authentication can help prevent stolen credentials from providing attackers with an initial foothold.

Article Details

Topic: QR code phishing attacks using malicious codes in emails and lure documents

People

Jonathan MunshawArticle author.

Vendors

CiscoThere was a significant increase in QR code phishing in 2023, according to public reporting and recently collected data from Cisco Talos Incident Response (Talos IR).

Products

Cisco DuoUsing multi-factor authentication protocols such as Cisco Duo can prevent credential stealing, which often provides threat actors with an initial foothold into targeted systems to send more convincing phishing emails Cisco Secure EmailAn email security solution, such as Cisco Secure Email, can detect these types of attacks. Secure Email specifically recently added new QR code detection capabilities in which the URLs are extracted from QR codes and Cisco Umbrelladeploy a mobile device management (MDM) platform or similar mobile security tool, such as Cisco Umbrella, to all unmanaged mobile devices that have access to business information. Cisco Umbrella’s DNS-layer Microsoft Office 365In a separate attack, the adversaries sent targets spear-phishing emails with malicious QR codes pointing to fake Microsoft Office 365 login pages that eventually steal the user’s login credentials when entered.