A massive phishing campaign using QR codes targets the energy sector

A phishing campaign employing QR codes targeted a leading energy company in the US, cybersecurity firm Cofense reported.

Starting from May 2023, researchers from Cofense discovered a large-scale phishing campaign using QR codes in attacks aimed at stealing the Microsoft credentials of users from multiple industries

One of the organizations targeted by hackers is a notable energy company in the US.

“Beginning in May 2023, Cofense has observed a large phishing campaign utilizing QR codes targeting the Microsoft credentials of users from a wide array of industries.” reads Cofense’s report. “The most notable target, a major Energy company based in the US, saw about 29% of the over 1000 emails containing malicious QR codes. Other top 4 targeted industries include Manufacturing, Insurance, Technology, and Financial Services seeing 15%, 9%, 7%, and 6% of the campaign traffic respectively.”

Most of the links included in the phishing messages were comprised of Bing redirect URLs. Other notable domains include krxd[.]com (associated with the Salesforce application), and cf-ipfs[.]com (Cloudflare’s Web3 services). 

The use of QR codes has several advantages over a phishing link embedded directly in an email, the most important one is the ability to bypass anti-phishing solutions because the phishing links are hidden inside the QR image.

The researchers observed an average month-to-month growth percentage of the campaign greater than 270%. The overall campaign has increased by more than 2,400% since May 2023.

According to the researchers, this is the largest campaign ever utilizing QR codes that was observed by Cofense, a circumstance that suggests that threat actors are testing the efficacy of QR codes.

The phishing messages used in this campaign include a PNG image or PDF attachments featuring a QR code. The content of the message attempt to trick the recipient into scanning the code to verify their account. The emails urge the recipient to complete the procedure in 2-3 days.

“Email lures came in the form of updating account security surrounding 2FA, MFA, and general account security. The Energy company saw 29% of the overall volume, however the company saw 81% of the campaign in which Bing redirect URLs were being used.” continues the report.

Experts warn that the Energy sector was a major focus of this campaign, followed by manufacturing, and insurance. The experts reported an increase in volume in the Energy sector that was due to a large 2-day campaign in late June. 

“While QR codes do have legitimate reasons to be used, malicious actors also have reasons to use them as well. The first is that QR codes with malicious artifacts can reach inboxes and the malicious link is hidden in the QR code. Secondly, they can be embedded into other images to disguise the QR code as an image attachment, or embedded image in a PDF file.” concludes the report. “While automation such as QR scanners and image recognition can be the first line of defense, it is not always guaranteed that the QR code will be picked up. Especially if it’s embedded into a PNG or PDF file. Therefore, it is also imperative that employees are trained not to scan QR codes in emails they receive.”

In January 2022, the Federal Bureau of Investigation (FBI) published a public service announcement (PSA) to warn that cybercriminals are using QR codes to steal their credentials and financial info.

The FBI announcement includes tips to protect people from such kind of attacks; feds recommend checking the URL obtained by scanning a QR code to make sure it is the intended site and looks authentic. Threat actors could use a malicious domain name that is similar to the intended URL but with typos or a misplaced letter.

Double-check any site navigated to from a QR code before providing login, personal, or financial information.

If scanning a physical QR code, ensure the code has not been tampered with, such as with a sticker placed on top of the original code.

Never download an app from a QR code, avoid making any payment requested through unsolicited email that uses social engineering techniques to trick recipients into scanning the embedded QR code.

Do not download a QR code scanner app from unofficial stores to avoid being infected with tainted apps, most phones today have a built-in scanner through the camera app.

If users will receive a QR code from someone they know, they can reach them via an alternative channel to verify that the code is from them.

Never make payments through a site navigated to from a QR code, it is recommended to manually enter a known and trusted URL to complete the payment.

In November, the FBI Internet Crime Complaint Center (IC3) published an alert to warn the public of fraudulent schemes leveraging cryptocurrency ATMs and Quick Response (QR) codes to complete payment transactions. This payment option makes it quite impossible to recover the money stolen with fraudulent schemes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, QR codes)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

DORA Compliance Strategy for Business Leaders

In January 2025, European financial and insurance institutions, their business partners and providers, must comply…

2 hours ago

CISA adds Android Pixel, Microsoft Windows, Progress Telerik Report Server bugs to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Android Pixel, Microsoft Windows, Progress Telerik Report…

9 hours ago

City of Cleveland still working to fully restore systems impacted by a cyber attack

Early this week, the City of Cleveland suffered a cyber attack that impacted multiple services.…

14 hours ago

Two Ukrainians accused of spreading Russian propaganda and hack soldiers’ phones

Ukraine’s security service (SBU) detained two individuals accused of supporting Russian intelligence in spreading propaganda…

15 hours ago

Google fixed an actively exploited zero-day in the Pixel Firmware

Google is warning of a security vulnerability impacting its Pixel Firmware that has been actively…

1 day ago

Multiple flaws in Fortinet FortiOS fixed

Fortinet released security updates to address multiple vulnerabilities in FortiOS, including a high-severity code execution…

1 day ago

This website uses cookies.