What is Quishing?
Quishing, also known as QR phishing, is a type of cyberattack in which harmful QR codes are used to take victims to fraudulent websites or force them to download software in an attempt to obtain private information, such as passwords and bank account details. To fool consumers, hackers include these fake QR codes inside emails, real-world addresses, or over authentic codes. consumers are unable to see the hidden URL until they scan the code. You may protect yourself by using a scanner app to preview the URL before accessing, being cautious of unsolicited QR codes, and looking for indications of tampering.
You can also read How Does Voice Phishing Work And Common Vishing Scenarios
How Quishing Attacks Work?
Because the human eye cannot read the URL or data included in the block of pixels that makes up a QR code, quishing takes advantage of this weakness to make it impossible to identify nefarious intent prior to scanning.
The attack typically follows several steps:
- Creation of Malicious Code: The attacker generates a QR code with a link that leads to a payment page, a malicious APK (installation file), a fraudulent website, or a link that initiates an undesirable action, like sending an SMS or OTP. Attackers may use obfuscated or truncated links to conceal the true domain.
- Distribution: Several physical and digital channels are used to spread the malicious QR codes:
- Digital Distribution: They are commonly included in phishing emails or texts, which usually include an urgent message (e.g., “Your account has been locked, scan to verify”). Because the malicious link can get past security measures because email filters frequently interpret the QR code as a harmless image, this strategy is very risky. Direct messages on Telegram or WhatsApp or social media posts can also be used to send them.
- Physical Distribution: Malicious QR codes are physically placed by attackers, frequently in the form of stickers, over authentic codes in public places like restaurant menus, posters, parking meters, ATM receipts or signs for public transit. Fake invoices, flyers, and documents may also contain them.
- Victim Interaction and Redirection: A fool uses the camera on their smartphone or a QR scanner app to scan the code. Once activated, the concealed action takes the user to a malicious website:
- An authentic imitation of a website (like a bank login page) that is intended to steal login credentials.
- An instant program download from a website could infect the device with viruses like ransomware or spyware.
- A website that requests private or sensitive financial data.
Why Quishing is Effective?
Due to its ability to get over numerous basic defenses and take advantage of user behaviors, quishing is still a tempting choice for cybercriminals:
Trust and Convenience: Users are less likely to be skeptical of QR codes because they are widely trusted and utilized for convenience in daily life, such as browsing restaurant menus, making purchases, or logging onto accounts.
Lack of Transparency: It’s hard to see a scam until the trap is set since, unlike regular links, which display the URL, a QR code’s concealed destination is only revealed when it is scanned.
Bypassing Security: Malicious codes, especially those seen in emails, can get past protected email gateways because they might mistake the QR code for a harmless image rather than a dubious URL.
Urgency Tactics: The use of urgency is a common tactic used by scammers to emotionally coerce their victims into acting quickly, such as fixing a purported account hack.
You can also read Examples of Social Engineering Attacks And How it Works
Quishing Examples
Quishing attacks manifest in several forms designed to trick specific targets:
Menu and Payment Scams: When a consumer tries to pay or browse the menu, a harmful code is placed over the genuine menu QR code of a restaurant, directing them to a fraudulent website that steals their financial information.
Parking Ticket Scams: putting phoney QR code stickers on vehicles or parking meters that direct drivers to a fraudulent payment gateway where credit card details are stolen.
Account Alerts: False emails or flyers purporting to be from banks or utility companies, stating that an account has been compromised or that a bill is due, and advising the recipient to scan the code to fix the problem or make an instant payment.
MFA Phishing: Multi-Factor Authentication (MFA) phishing is the practice of sending emails asking users to scan a code to renew their credentials since MFA is about to expire.
How to Protect Yourself from Quishing
Be Suspicious of Unsolicited QR Codes: Exercise extreme caution when responding to QR codes that appear in messages, emails, or fliers from unexpected or unknown sources.
Verify the URL: Give the URL that the camera app on your phone displays a close look at before clicking “open link” after scanning a QR code. Check for typos, extraneous characters, or a domain name that isn’t what you usually see.
Physically Inspect the Code: If the QR code is located on a tangible surface, look for any indications of tampering. Over a different code, is it a sticker? Is it poorly printed or does it look out of place?
Avoid Shortened URLs: Be very wary of shortened URLs (like bit.ly or tinyurl) that pop up after scanning a code, as they can easily hide a malicious destination.
Don’t Enter Sensitive Information: Reputable businesses rarely ask for critical information, such as a credit card number, password, or social security number, after you scan a QR code. Shut off the page right away if it requests it.
Use Multi-Factor Authentication (MFA): MFA adds a vital layer of protection that makes it much more difficult for hackers to access your accounts, even if they manage to obtain your credentials.
Report It: Notify the manager or owner of the company if you witness a dubious QR code in a public setting. Inform your IT department or the appropriate authorities if you receive an email that seems suspicious.
If you (or someone) scanned a malicious QR
- Turn off Wi-Fi and cellular and disconnect from the network right away.
- No credentials should be entered or permissions should be approved.
- If credentials were entered, enable MFA and update the passwords from a secure device.
- If you suspect malware, you can either factory-reset the device or use mobile security apps to scan it.
- If your financial information was compromised, get in touch with your bank and keep an eye on transactions.
- Notify the platform/location owner and the appropriate authorities about the malicious QR code.
You can also read Clone Phishing Definition And How To Prevent Clone Phishing