01/03/2025
The Rising Threat of Quishing Attacks
Attackers are now using malicious QR codes in credential phishing and invoice payment fraud attacks. In fact, Abnormal customer data shows that 17% of all attacks bypassing native security controls contain a QR code. These malicious QR codes often link to what appears to be a legitimate website, such as Google or Microsoft login pages, and prompt recipients to enter their login credentials, which are then exploited by the attacker.
Here are some ways QR codes can be used for malicious purposes:
Phishing
Criminals can send emails with QR codes that direct users to fake websites that look like legitimate companies. These websites may ask for personal information like login credentials, banking information, or credit card details.
Social engineering
Criminals can use social engineering tactics to trick people into scanning QR codes. For example, they may place a QR code in a public area without any text, or pair it with a well-crafted message.
Tampering
Criminals can replace legitimate QR codes with counterfeit ones. For example, they may put a sticker over a legitimate QR code on a parking meter.
To avoid QR code scams, you can:
Check the URL destination: Before opening the link, you can long-press-and-hold on mobile devices to check the URL and QR code destination. On a computer, you can hover over a link to inspect the link destination.
Use your own search engine: Instead of scanning a QR code, you can navigate to the intended website or profile using your own search engine.
Only scan codes from trusted senders: Mobile users should only scan codes that come from a trusted sender.
