Trying to make sense of recent QR code phishing targeting US institutions

J

Jason Mills

Member
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
 
Jason Mills said:
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
Click to expand...
Thanks for sharing this. I hadn’t heard about QR code phishing in this way before. I usually think of phishing as emails or links, but using QR codes seems clever. Do you know if there have been any confirmed cases where credentials were actually stolen this way, or is it mostly a warning?
 
Ethan Hughes said:
Thanks for sharing this. I hadn’t heard about QR code phishing in this way before. I usually think of phishing as emails or links, but using QR codes seems clever. Do you know if there have been any confirmed cases where credentials were actually stolen this way, or is it mostly a warning?
Click to expand...
I think the FBI report mentions incidents targeting government and academic accounts, but I don’t recall if they gave exact numbers of successful breaches. The idea that they can bypass MFA is a bit concerning, though. It makes me think that mobile devices might be the weakest link here.
 
Jason Mills said:
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
Click to expand...
This is fascinating. I’ve seen QR codes used for payments and promotions, but not much as a phishing tool. The redirection to collect session tokens seems particularly sneaky. I wonder how much training employees in spotting suspicious QR codes actually helps in practice.
 
Jason Mills said:
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
Click to expand...
I’ve been following Kimsuky a little. From past reports, they seem to focus on very specific high-value targets rather than random users. So if you’re in a smaller organization, the risk might be lower, but still not zero.
 
Ethan Hughes said:
Thanks for sharing this. I hadn’t heard about QR code phishing in this way before. I usually think of phishing as emails or links, but using QR codes seems clever. Do you know if there have been any confirmed cases where credentials were actually stolen this way, or is it mostly a warning?
Click to expand...
Yes, the report implies that once the session token is captured, MFA might not even trigger an alert, because the attackers can use the token to log in directly. It’s different from traditional password-only phishing.
 
Jason Mills said:
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
Click to expand...
I’m curious about the technical part. How does this QR code bypass MFA exactly? I know the report mentions session token replay, but does that mean even a correctly entered MFA code wouldn’t stop them?
 
Jason Mills said:
Yes, the report implies that once the session token is captured, MFA might not even trigger an alert, because the attackers can use the token to log in directly. It’s different from traditional password-only phishing.
Click to expand...
Ah, that explains it. That is really sneaky. Makes me rethink scanning QR codes in emails or untrusted sources entirely.
 
Amelia Bennett said:
This is fascinating. I’ve seen QR codes used for payments and promotions, but not much as a phishing tool. The redirection to collect session tokens seems particularly sneaky. I wonder how much training employees in spotting suspicious QR codes actually helps in practice.
Click to expand...
Training probably helps, but only if employees are vigilant. The problem is these QR codes look very legitimate, sometimes even embedded in images that look official.
 
Jason Mills said:
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
Click to expand...
I also wonder how widespread this attack vector is outside government agencies. Are commercial organizations being hit too, or is it mainly targeted attacks?
 
Jason Mills said:
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
Click to expand...
The report focuses on high-profile targets, but similar tactics could be adapted for businesses if attackers think it’s profitable. It’s worth being cautious even if you’re not in government or academia.
 
Emily Watson said:
The report focuses on high-profile targets, but similar tactics could be adapted for businesses if attackers think it’s profitable. It’s worth being cautious even if you’re not in government or academia.
Click to expand...
I guess the takeaway is to be skeptical of QR codes from emails or unexpected messages. Even official-looking ones could be malicious.
 
Jason Mills said:
Hey everyone, recently I found some interesting info in an FBI report about a North Korean group called Kimsuky. It seems they are using QR codes in phishing emails to try and steal login credentials from US government institutions, think tanks, and academic organizations. The emails reportedly look quite convincing, and since QR codes are harder for normal protections to detect, they can bypass some standard security measures.

From what I understand, when someone scans these QR codes, they get redirected through multiple pages that collect info like device type, location, and other identifiers before reaching a fake login portal for services like Microsoft 365, Okta, or VPNs. The report mentions that this can even bypass multi-factor authentication, which surprised me a bit because MFA is usually a strong layer of defense.

The FBI suggests a “multi-layered” defense, like employee training, protocols for reporting suspicious QR codes, and mobile device management for analyzing these links. I’m curious if any of you have heard about Kimsuky’s activity before or seen similar attacks in other contexts. It makes me wonder how widespread these QR-based phishing attacks really are, especially for organizations outside the usual corporate setup. Also, are there particular signs we could look for when scanning QR codes to avoid falling into traps like these?

Just wanted to start a conversation to see what others think. The report is publicly available and seems to be based on solid observations, but the whole quishing technique seems pretty sneaky and not something most people would anticipate.
Click to expand...
Do we know if there are any public tools or apps that can pre-check QR codes before scanning? Could be helpful for organizations deploying MFA-sensitive apps.
 

Legal notice

ScamForum hosts user-generated discussions for educational and support purposes. Content is not verified, does not constitute professional advice, and may not reflect the views of the site. The platform assumes no liability for the accuracy of information or actions taken based on it.

Back
Top