Phishing Beyond Email: Vishing, Smishing, QR Codes and Deepfakes

Summary

DarkOwl outlines phishing methods beyond email, including voice, SMS, QR-code and deepfake scams. It describes how they can deceive victims and advises checking QR-code destinations before opening them.

Key points

• The article cites an IBM report stating phishing accounted for 41% of initial access in 2023, up from 30% in 2022.
• Vishing uses calls or voicemail, with caller-ID spoofing and robocalls helping scammers impersonate trusted entities.
• Smishing messages use lures such as delivery updates or fake voter-registration forms to direct recipients to credential-stealing pages.
• Quishing can use malicious QR codes to send victims to lookalike sites or malware; the article recommends previewing the destination before interacting.
• Deepfake-based phishing is described as not yet widespread, though the article says its potential impact could grow as the technology becomes more accessible.
• The article notes a 2020 U.S. federal indictment involving an India-based VoIP company and robocalls estimated to have caused $20 million in losses.

MITRE ATT&CK

Countries