Threat Spotlight: The evolving use of QR codes in phishing attacks

• 

  Barracuda threat intelligence researchers have detected more than half a million phishing emails with quick response (QR) codes embedded in PDF documents.

• QR codes that lead to phishing websites are now being included in PDF documents and attached to emails — versus being included in the emails themselves.
• The attacks are designed to capture login credentials for compromise.

Quishing attacks by the numbers

In a three-month period, Barracuda researchers identified and analyzed more than half a million phishing emails with QR codes embedded in PDF documents.

In most of the attack samples analyzed by Barracuda researchers, scammers impersonate well-known companies. Microsoft, including SharePoint and OneDrive, is impersonated in more than half (51%) of all the attacks, followed by DocuSign (31%), and Adobe (15%). In a small number of the attacks, scammers impersonate the human resources department at the intended victim’s company.

In these attacks, cybercriminals send phishing emails and attach a simple one or two-page PDF document that includes a QR code. No other external links or embedded files are included in the PDF. Recipients are directed to scan the QR code with the camera on their mobile phone, so they can view a file, sign a document, or listen to a voice message. If they do so, they are brought to a phishing website designed to capture their login credentials.

Brands being impersonated

Scammers impersonate well-known brands and use social engineering tactics to trick victims.

Quishing poses some unique security challenges for businesses. Traditional email filters struggle to detect these attacks because there are no direct links or suspicious attachments to scan. Additionally, quishing often involves multiple devices: employees receive the phishing email on one device but scan the QR code using a different device, such as a personal mobile phone that may lack the same level of security protection as corporate systems. As a result, these attacks can bypass corporate defenses, making them difficult to track or prevent.

Certain industries — such as finance, healthcare, and education — are increasingly being targeted by quishing attacks due to the sensitive data they handle. Small-to-medium businesses (SMBs) are especially vulnerable since they often lack the advanced security tools needed to protect against these sophisticated phishing tactics. The shift in tactics from embedding QR codes in the body of an email to attaching them in PDF documents makes it harder for traditional defenses to identify and block these attacks before they reach employees.

Examples of quishing emails

In this phishing email that impersonates DocuSign, the recipient is directed to scan the QR code in an attached PDF document to review and electronically sign “secured documents”.