Pierluigi Paganini
August 16, 2023
Starting from May 2023, researchers from Cofense discovered a large-scale phishing campaign using QR codes in attacks aimed at stealing the Microsoft credentials of users from multiple industries
One of the organizations targeted by hackers is a notable energy company in the US.
“Beginning in May 2023, Cofense has observed a large phishing campaign utilizing QR codes targeting the Microsoft credentials of users from a wide array of industries.” reads Cofense’s report. “The most notable target, a major Energy company based in the US, saw about 29% of the over 1000 emails containing malicious QR codes. Other top 4 targeted industries include Manufacturing, Insurance, Technology, and Financial Services seeing 15%, 9%, 7%, and 6% of the campaign traffic respectively.”
Most of the links included in the phishing messages were comprised of Bing redirect URLs. Other notable domains include krxd[.]com (associated with the Salesforce application), and cf-ipfs[.]com (Cloudflare’s Web3 services).
The use of QR codes has several advantages over a phishing link embedded directly in an email, the most important one is the ability to bypass anti-phishing solutions because the phishing links are hidden inside the QR image.
The researchers observed an average month-to-month growth percentage of the campaign greater than 270%. The overall campaign has increased by more than 2,400% since May 2023.
According to the researchers, this is the largest campaign ever utilizing QR codes that was observed by Cofense, a circumstance that suggests that threat actors are testing the efficacy of QR codes.
The phishing messages used in this campaign include a PNG image or PDF attachments featuring a QR code. The content of the message attempt to trick the recipient into scanning the code to verify their account. The emails urge the recipient to complete the procedure in 2-3 days.
“Email lures came in the form of updating account security surrounding 2FA, MFA, and general account security. The Energy company saw 29% of the overall volume, however the company saw 81% of the campaign in which Bing redirect URLs were being used.” continues the report.
Experts warn that the Energy sector was a major focus of this campaign, followed by manufacturing, and insurance. The experts reported an increase in volume in the Energy sector that was due to a large 2-day campaign in late June.
“While QR codes do have legitimate reasons to be used, malicious actors also have reasons to use them as well. The first is that QR codes with malicious artifacts can reach inboxes and the malicious link is hidden in the QR code. Secondly, they can be embedded into other images to disguise the QR code as an image attachment, or embedded image in a PDF file.” concludes the report. “While automation such as QR scanners and image recognition can be the first line of defense, it is not always guaranteed that the QR code will be picked up. Especially if it’s embedded into a PNG or PDF file. Therefore, it is also imperative that employees are trained not to scan QR codes in emails they receive.”
In January 2022, the Federal Bureau of Investigation (FBI) published a public service announcement (PSA) to warn that cybercriminals are using QR codes to steal their credentials and financial info.
The FBI announcement includes tips to protect people from such kind of attacks; feds recommend checking the URL obtained by scanning a QR code to make sure it is the intended site and looks authentic. Threat actors could use a malicious domain name that is similar to the intended URL but with typos or a misplaced letter.
Double-check any site navigated to from a QR code before providing login, personal, or financial information.
If scanning a physical QR code, ensure the code has not been tampered with, such as with a sticker placed on top of the original code.
Never download an app from a QR code, avoid making any payment requested through unsolicited email that uses social engineering techniques to trick recipients into scanning the embedded QR code.
Do not download a QR code scanner app from unofficial stores to avoid being infected with tainted apps, most phones today have a built-in scanner through the camera app.
If users will receive a QR code from someone they know, they can reach them via an alternative channel to verify that the code is from them.
Never make payments through a site navigated to from a QR code, it is recommended to manually enter a known and trusted URL to complete the payment.
In November, the FBI Internet Crime Complaint Center (IC3) published an alert to warn the public of fraudulent schemes leveraging cryptocurrency ATMs and Quick Response (QR) codes to complete payment transactions. This payment option makes it quite impossible to recover the money stolen with fraudulent schemes.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, QR codes)
Malware / September 09, 2025
