Skip to content

At The Identity Organisation, we're here to help!

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038

    QR Code Phishing Attacks Surging

    The massive uptick in QR Code phishing is an indicator that scammers are seeing success in taking victims from the initial attack medium to one under the attacker’s control.

    It’s usually bad when we compare one month or quarter to another and see an increase.  But when it’s a single month compared to more than half a year, you know it’s REALLY bad. And that’s what we find in security vendor ReliaQuest’s latest blog covering how Quishing is being used.

    According to ReliaQuest, when comparing the cumulative amount of quishing in January through August of this year with September, there was a 51% increase!

    More than half (56%) of quishing emails involved resetting two-factor authentication. And slightly less than one-fifth (18%) of quishing emails involved spoofed banking pages.

    The cybercriminals behind the quishing attacks are leveraging every possible means of obfuscating the malicious nature of their QR codes, including “smuggling” the QR code in a PDF or image file so it can’t be detected occurred in 12% of attacks.  Also the use of legitimate web platforms was common in 18% of attacks to fend off any security scanner that would attempt to check the destination URL, not realizing that the initial link is merely a cleverly disguised redirect to a malicious site.

    It seems a bit ludicrous that anyone would fall for a quishing attack, given the awkward user experience that exists when asking someone to not simply click a link (no, no – that would be FAR too easy!), but instead pull out your phone and use the camera’s QR code recognition capabilities to take you to the intended destination. Despite the required switch of devices, these attacks are growing in popularity.

    So, it becomes necessary to ensure that your users realize that there isn’t a single legitimate business instance where one company is going to require another to open and email, scan a QR code, and complete the business transaction, etc. on their mobile device.  It’s either going to be common sense, or your users simply need to take new-school security awareness training to be reminded that this kind of effort is malicious in nature and should be avoided.

    KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

    Free Phishing Security Test

    Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

    Here’s how it works:

    • Immediately start your test for up to 100 users (no need to talk to anyone)
    • Select from 20+ languages and customize the phishing test template based on your environment
    • Choose the landing page your users see after they click
    • Show users which red flags they missed, or a 404 page
    • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
    • See how your organization compares to others in your industry

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser:

    Sign Up to the TIO Intel Alerts!

    Back To Top