Highlights:

  • The report underscores the weaknesses and potential hazards linked to the unaware usage of QR codes.
  • The report highlights the evolving tactics of cybercriminals, particularly their growing inclination to use QR codes as attack vectors.

SlashNext Inc., a phishing protection company, has released a new report that warns that more and more cybercriminals are taking advantage of the widespread use of QR codes to launch sophisticated phishing attacks.

The study draws attention to the weaknesses and possible dangers that come with using QR codes carelessly. The report also highlights the pressing need for protective measures and increased awareness of digital security with regard to QR codes.

Quick Response (QR) codes have become remarkably popular. Driven by the almost universal adoption of smartphones, barcodes have become one of the most versatile tools of the modern era, having been first developed in 1994 by a Japanese automobile manufacturing firm to track parts. QR codes have become ubiquitous in modern life, appearing in everything from digital payments and restaurant menus to contactless ticketing and marketing campaigns.

Despite their convenience, QR Codes have a drawback in that they can be used maliciously, and they already are. A portmanteau of “phishing” and “QR,” – Quishing, has gained popularity as a result of the report’s warning that hackers are using QR codes to embed malware downloads and phishing links.

Unwary users who believe QR codes to be legitimate may be tricked into downloading malware onto their devices unintentionally or diverted to malicious websites that steal confidential information. Due to cybercriminals taking advantage of the growing dependence on contactless operations, these threats have become more apparent since the COVID-19 pandemic.

QRLJacking, or Quick Response Code Login Jacking, is a more specialized threat that is another risk mentioned in the report. Many apps and websites have adopted the “login with QR code” feature, which attackers are taking advantage of. In order to hijack a user’s session, a common QRLJacking technique involves tricking the user into scanning a controlled QR code.

The report’s conclusion highlights how cybercriminals are evolving their attack strategies, particularly their growing inclination to use QR codes as attack vectors. Cybercriminals are profiting from people’s trust in QR codes and their general ignorance of possible risks.

SlashNext supports a multi-layered strategy to lessen the risks that malicious QR codes present. First and foremost, there is an immediate need for campaigns to raise user awareness and educate them about QR codes, especially when they come from unreliable sources. Organizations should also update and improve their security protocols by adding protection designed to recognize and scan malicious QR codes.

According to Timothy Morris, Chief Security Advisor at cybersecurity and systems management firm Tanium Inc, users should be highly wary of QR codes that arrive via email.

He said, “As we see with any phishing attempt, be suspicious of anything from unknown sources or that instills a sense of urgency. Report it as a phish, delete it, or ignore it. For enterprises, it is of the utmost importance to employ good email security, use web content filtering, and provide user training.”