QR code phishing (quishing)
A phishing variant that hides the malicious link in a QR code, to evade email filters and push the victim to open it on a phone, less protected than a work computer.
Corporate email security gateways analyze links in emails and block those leading to malicious sites. A QR code, however, is just an image: the filter does not see the link it contains. The attacker therefore sends a message claiming a security update, an e-signature or a payment notice, with a QR code to scan. The victim scans it with a personal phone, outside the perimeter the company protects, and lands on a fake login page that captures credentials, or even the session. The technique has also spread into the physical world: fake codes stuck on parking meters, charging stations or menus, redirecting to fraudulent payment pages. It rose sharply from 2023. It exploits two weaknesses at once: the habit, formed during the pandemic, of scanning without thinking, and the weaker protection of mobile devices. Countermeasures combine image analysis by email gateways, awareness training, and phishing-resistant authentication, which makes captured credentials useless. For insurance, it is a reminder that the security perimeter declared in the questionnaire does not cover employees' personal phones.
Textbook case: employees receive an email branded as the IT department asking them to scan a QR code to renew their authentication before Friday. Three of them enter their credentials on the resulting page from their phones; one has admin rights on the mail system.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.