As we have warned before, threat actors using QR codes in attacks against victims continue to rise. To illustrate the risk, on January 8, 2026, the FBI issued a FLASH alert, entitled “North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities.”
The alert warns that North Korean state-sponsored actors (Kimsuky) are conducting spearphishing campaigns leveraging QR codes (Quishing) to compromise U.S. entities. These attacks target organizations including think tanks, academic institutions, NGOs, and government contractors.
The threat attackers are embedding malicious QR codes in email attachments or graphics through spearphishing emails impersonating trusted contacts (e.g., advisors, embassy staff). When victims receive the QR code, they scan them using mobile devices, which allows the threat actor to bypass corporate email security and endpoint monitoring. After scanning the QR code, the victim is routed through “attacker-controlled redirectors that collect device and identity attributes” and serve phishing pages mimicking Microsoft 365, Okta, VPN portals, or Google login screens.
The threat actor is then able to steal credentials to enable unauthorized access to cloud services. Since the attacks originate from unmanaged mobile devices, threat detection is difficult.
The FBI recommends:
- Employee Awareness: Train staff to avoid scanning unsolicited QR codes.
- Verify Sources: Confirm legitimacy before interacting with QR codes.
- Mobile Device Management (MDM): Enforce security controls on all mobile endpoints.
- Phishing-Resistant MFA: Implement for sensitive systems and remote access.
- Access Reviews: Apply least privilege and conduct regular audits.
- Incident Reporting: Notify the FBI Cyber Division or IC3 immediately if suspicious activity is detected.
As we have previously noted, employees are particularly vulnerable to Quishing campaigns as many don’t understand the technology and QR codes are now ubiquitous. When we conduct employee training, this lack of understanding is reinforced. We strongly recommend that you educate your employees about Quishing. If you are interested in learning more about our cybersecurity training, please contact us.
[View source.]
