QR Code phishing is advancing to a new level, so be on your guard
Dangerous new phishing campaigns employ multiple QR codes
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Be careful when receiving emails with QR codes, because Quishing (QR code phishing) has evolved to become as dangerous as never before, experts have warned.
A report fromPerception Pointhas outlined one such campaign, claiming it is able to bypass mostemail security solutionsaround.
The attack is just like any other QR code phishing attack - the recipient gets an email, and in it a QR code. They scan it, and it leads them to a fakeMicrosoft365 landing page, where they type in their login credentials and essentially share it with the crooks. However, since most email security solutions these days come with QR code scanners, simply sending the image in the email will not suffice. Such emails will simply get blocked, which is why crooks came up with a creative new way of bypassing the protections.
Two QR codes
As Perception Point explains, the campaign involves abusing two legitimate services - SharePoint, and me-qr.com. SharePoint is a Microsoft-built, web-based platform for collaboration, document management, and content sharing. Me-QR.com is a website where users can create and manage QR codes.
The landing page is hosted on SharePoint. Me-QR.com is used as an additional obfuscation layer, so that the scanners cannot read where the QR code points to.
Here is how the scam works: The recipient gets the usual phishing email, containing a .PDF attachment that’s either a purchase order, an invoice, or something similar. When they open it, there is a QR code that points to me-QR.com. Since this is a legitimate service, the code passes security scans.
When the victim scans this code, they are redirected to me-QR.com, where the service scans a second QR code (a malicious one, which would most likely be blocked by email security). This code leads to SharePoint, where the phishing page is hosted.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Perception Point calls this tactic “Quishing 2.0”, and describes it as highly sophisticated.
The best way to defend against spam remains the same - be suspicious of all incoming emails and use common sense when opening up attachments.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
Belkin’s Travel Bag for Vision Pro has pockets and is way cheaper than Apple’s own case
