Full Report
Quishing has become a popular alternative to traditional phishing. Here’s how businesses can close the gap.
Analysis Summary
# Tool/Technique: Quishing (QR Code Phishing)
## Overview
Quishing is a social engineering technique that utilizes malicious QR codes (Quick Response codes) to deliver phishing links or malware. The primary purpose is to bypass traditional email security filters that inspect text-based URLs and to shift the attack from a monitored corporate workstation to a less secure personal mobile device.
## Technical Details
- **Type:** Technique / Attack Vector
- **Platform:** Cross-platform (Targets mobile devices via iOS/Android, impacting corporate environments)
- **Capabilities:** URL obfuscation, MFA token harvesting, malware distribution, and bypassing Secure Email Gateways (SEGs).
- **First Seen:** While QR codes are older, a significant surge in quishing was documented in 2025-2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566 - Phishing]**
- **[T1566.003 - Phishing: Voice/SMS/QR Code]** (Note: QR code specifically falls under the Spearphishing Link or Service sub-techniques in evolving frameworks).
- **[TA0006 - Credential Access]**
- **[T1557 - Adversary-in-the-Middle]** (Used for harvesting MFA tokens).
- **[TA0002 - Execution]**
- **[T1204.001 - User Execution: Malicious Link]**
## Functionality
### Core Capabilities
- **Visual Obfuscation:** Encodes malicious URLs into a 2D barcode that is unreadable by humans and many legacy automated scanners.
- **Security Filter Evasion:** Bypasses basic optical character recognition (OCR) and text-based filters by embedding the code within PDF or JPEG attachments.
- **Platform Switching:** Forces users to scan the code with a mobile phone, moving the session away from corporate endpoint protection and onto potentially unmanaged devices.
### Advanced Features
- **MFA Token Harvesting:** Directs users to "EvilProxy" or similar Adversary-in-the-Middle (AiTM) frameworks to steal session cookies and bypass Multi-Factor Authentication.
- **Dynamic Generation:** Many modern phishing kits now include dedicated QR-code generators to create unique codes for each target.
- **App Store Bypass:** Directing users to download malicious configuration profiles or apps directly, bypassing official app store security.
## Indicators of Compromise
- **File Names:** Common lures include "Secure_Account_Update.pdf," "DocuSign_Invoice.jpg," or "MFA_Verification.png."
- **Network Indicators:**
- `hxxps[:]//[random-string].s3.amazonaws.com` (Use of legitimate cloud hosting to house the QR landing page).
- Defanged phishing infrastructure associated with Kimsuky or AiTM kits.
- **Behavioral Indicators:**
- High volume of emails containing image-only attachments with minimal text.
- User sessions originating from mobile devices immediately following the receipt of an email on a desktop client.
## Associated Threat Actors
- **Kimsuky (North Korea):** Known to target think tanks and government entities using QR codes to lead victims to fake registration pages and questionnaires.
- **General Phishing Actors:** Broadly used by cybercriminals for credential harvesting and financial fraud.
## Detection Methods
- **Signature-based detection:** ESET identifies this under the detection name **QRCode/Phishing**.
- **Behavioral detection:** Monitoring for "Cross-Device" anomalies where a user logs in from a mobile device immediately after interacting with an email on a PC.
- **Image Analysis:** Implementing email security layers that utilize OCR and specialized QR-decoding engines to extract and inspect the destination URL against threat intelligence databases.
## Mitigation Strategies
- **Technical Controls:**
- Deploy email security solutions capable of decoding QR codes within attachments.
- Implement Phishing-Resistant MFA (e.g., FIDO2/WebAuthn) to prevent token harvesting.
- Use Mobile Device Management (MDM) to enforce security policies on mobile endpoints.
- **Hardening:**
- Apply the principle of Least Privilege and Just-In-Time access.
- Ensure all mobile operating systems are patched and updated.
- **User Awareness:**
- Conduct specific "Quishing" simulations.
- Educate staff to never scan QR codes in unsolicited emails and to verify "urgent" requests via out-of-band communication.
## Related Tools/Techniques
- **Smishing:** Phishing via SMS (often combined with QR codes).
- **AiTM (Adversary-in-the-Middle):** Used in conjunction with quishing to bypass MFA.
- **Typosquatting:** Often used for the landing pages encoded within the QR code.