Threat actors continue to take advantage of the increased adoption of QR code scanning, as users are typically quick to scan QR codes without a second thought and are unaware of the potential risks. In quishing campaigns, threat actors impersonate trusted organizations or entities, including human resources or information technology departments. QR codes may be embedded in Adobe PDF, Microsoft Word, HTML, attached images, or directly in the body of the email. Threat actors use legitimate software tools and QR codes that appear genuine or official but may be tampered with, directing targets to phishing websites and fraudulent payment portals to steal sensitive information, account credentials, or funds. These campaigns can also deliver malware, ransomware, or trojans that automatically download, infiltrate devices, and launch further attacks.

The NJCCIC’s email security solution identified and blocked multiple quishing campaigns attempting to deliver malicious QR codes to New Jersey State employees. In one example, threat actors use Microsoft branding and change the sender’s display name to “Tech” despite the EXTERNAL tag indicating that the email originates from outside the organization. They lure their targets with convincing human resource themes, including a misspelled Employee Handbook attachment.

If the Adobe PDF attachment is clicked, it will display a two-page document with a QR code and additional Microsoft branding. If the QR code is scanned, the target is directed to hxxps://2jzy[.]inerecono[.]ru/Gi56TU6/#D[recipientemailaddress]. In this example, the target is prompted to verify that they are human, and the malicious website displays purported information on artificial intelligence technology.