Be careful when receiving emails with QR codes, because Quishing (QR code phishing) has evolved to become as dangerous as never before, experts have warned.
A report from Perception Point has outlined one such campaign, claiming it is able to bypass most email security solutions around.
The attack is just like any other QR code phishing attack – the recipient gets an email, and in it a QR code. They scan it, and it leads them to a fake Microsoft 365 landing page, where they type in their login credentials and essentially share it with the crooks. However, since most email security solutions these days come with QR code scanners, simply sending the image in the email will not suffice. Such emails will simply get blocked, which is why crooks came up with a creative new way of bypassing the protections.
Two QR codes
As Perception Point explains, the campaign involves abusing two legitimate services – SharePoint, and me-qr.com. SharePoint is a Microsoft-built, web-based platform for collaboration, document management, and content sharing. Me-QR.com is a website where users can create and manage QR codes.
The landing page is hosted on SharePoint. Me-QR.com is used as an additional obfuscation layer, so that the scanners cannot read where the QR code points to.
Here is how the scam works: The recipient gets the usual phishing email, containing a .PDF attachment that’s either a purchase order, an invoice, or something similar. When they open it, there is a QR code that points to me-QR.com. Since this is a legitimate service, the code passes security scans.
When the victim scans this code, they are redirected to me-QR.com, where the service scans a second QR code (a malicious one, which would most likely be blocked by email security). This code leads to SharePoint, where the phishing page is hosted.
Perception Point calls this tactic “Quishing 2.0”, and describes it as highly sophisticated.
The best way to defend against spam remains the same – be suspicious of all incoming emails and use common sense when opening up attachments.
This article first appeared in Tech Radar, written by Sead Fadilpašić on October 1, 2024.
