Phishing Alert: QR Codes in Email Attachments Pose New Threats

TL;DR

Cybercriminals are increasingly using QR codes in email attachments to phish unsuspecting victims. These QR codes often lead to malicious sites designed to steal personal information or distribute malware. Users are advised to keep their devices updated, use reliable anti-malware software, and scan QR codes with caution.

Main Content

Recently, there has been a surge in phishing campaigns utilizing QR codes embedded in email attachments. This tactic is becoming a preferred method for cybercriminals due to its effectiveness in bypassing traditional email filters and targeting users, particularly on mobile devices.

Why Cybercriminals Use QR Codes

The use of QR codes in phishing attacks offers several advantages to cybercriminals:

• Mobile Device Targeting: QR codes are typically scanned using mobile devices, which often have less robust security measures against malicious websites.
• Direct Access to Personal Accounts: Mobile devices frequently contain personal apps, such as banking applications, providing attackers direct access to sensitive information.
• Difficulty in Detection: QR codes are not easily identifiable as malicious by humans, making them an effective tool for deception.
• Bypassing Email Filters: Unlike traditional links, QR codes embedded as images can evade detection by email security filters.
• Trust Exploitation: The widespread use of QR codes in legitimate applications, such as banking apps, can instill a false sense of trust in users.

Combining Techniques for Enhanced Phishing

When combined with other known phishing techniques, QR codes become a potent tool for cybercriminals. For instance, attackers often use URL shorteners to obscure the final destination of the QR code, making it harder for users to identify the threat.

Real-World Examples

Cybercriminals embed QR codes in professionally designed documents mimicking legitimate sources such as HR portals, payroll updates, or e-signature services like DocuSign or Adobe. These documents often include detailed instructions on how to scan the QR code, enhancing their credibility.

“To conveniently access and navigate the contents of the updated Employee Handbook, please scan the QR code provided below. This will direct you to the digital version of the handbook for easy reference and exploration.

{QR code}

Should you have any questions, please do not hesitate to contact the HR department.”

In one documented case, a four-page document resembling an updated employee handbook directed users to scan a QR code with their smartphone camera. The QR code led to a website that redirected users based on their email address, prompting corporate email users to log in with their Microsoft accounts.

“Step-by-Step Guide

1. Open your camera app: Launch the camera app on your smartphone.
2. Point at the QR code: Align your camera lens with the QR code, ensuring it is fully visible within the frame.
3. Wait for recognition: Your phone will automatically detect the QR code and display a notification or link on the screen.
4. Access the content: Tap on the notification or link to open the information associated with the QR code.”

Protection Against QR Code Phishing

To safeguard against QR code phishing attacks, consider the following steps:

Keep Your Device Up-to-Date

Ensure your devices are receiving the latest updates. You can check your device’s update status in the Settings app under About phone or About device. Regularly check for updates to maintain optimal security.

Scan QR Codes with Caution

Use a QR code scanner app that displays the full URL before redirecting you. Avoid using apps that automatically execute actions like opening websites or downloading files. Modern Android devices (version 8 and above) have built-in QR code scanning capabilities in the camera app.

Use Anti-Malware Protection

Protect your mobile devices with reliable anti-malware software. Malwarebytes offers protection for both Android and iOS devices.

Conclusion

QR code phishing represents a growing threat, particularly for mobile device users. By staying informed and taking proactive security measures, users can protect themselves from these evolving phishing tactics. For enhanced protection, consider using comprehensive security solutions like Malwarebytes.

Additional Resources

For further insights, check:

• Obfuscated URLs: Where Is That Link Taking You?
• Urgent Reminder: Tax Scam Wants to Phish Your Microsoft Credentials
• PayPal Scam Abuses DocuSign API to Spread Phishy Emails