What is Quishing? (QR Code Phishing) Learn how to stay safe

Jason McNicholas

Cyber Essentials Plus Assessor

12th July 2024

Cybercriminals continuously devise creative methods to steal your money and data. Consequently, staying informed about these new threats and knowing how to detect and counteract them is essential. Recently, a specific variant of phishing known as 'Quishing' has gained prominence. This article will shed light on this emerging attack, which has become increasingly common in recent months. Quishing represents a new and specialized form of the broader phishing tactic.

A recap on Phishing

You’re likely familiar with phishing in some capacity and may have even experienced a phishing attempt yourself. If you need a quick refresher, this 'what is phishing' article provides a solid overview. Phishing comes in various forms, such as spear phishing, whaling, smishing, and vishing. It's a type of social engineering where scammers impersonate trusted entities like friends, subscription services, or banks to persuade individuals to:

Disclose confidential information
Click on harmful links
Provide login credentials

Understanding these tactics can help you better recognize and avoid falling victim to such scams.

Quishing explained

Quishing is an emerging form of phishing that leverages QR codes, gaining popularity in recent times. You might have encountered it already. A QR code, short for Quick Response code, is a two-dimensional barcode storing information in a machine-readable format. Your smartphone camera can read and interpret these codes, which can hold various types of information. QR codes are versatile and can be used for multiple purposes, such as:

Linking to websites
Making instant payments
Storing event ticket information
Saving contact details directly to a device

QR codes look like this:

*This QR code is not malicious and links to the Bulletproof.co.uk homepage*

How does quishing work?

In a quishing attack, hackers use QR codes to trick users into engaging in harmful activities, similar to other phishing tactics. They create a malicious QR code that, when scanned, can lead to fake websites, bogus login pages, or malware-laden URLs. Often, these QR phishing attempts arrive through phishing emails posing as reputable companies or from a friend’s compromised email. Social media and messaging apps like WhatsApp also serve as attack vectors for quishing.

Scanning QR codes from unverified sources can expose you to these scams. Always be cautious before you scan a QR code, as these fake QR codes can easily bypass traditional spam filters and antimalware protections.

How to protect yourself against quishing attacks?

Quishing can bypass spam filters and antimalware protection that typically scan emails. While a spam filter or antimalware software would block a malicious link in an email, a QR code might be perceived as just an image and go undetected.

Cybersecurity is a constant battle between defenders and cybercriminals. New technologies bring new challenges, often exploited first by bad actors. Although QR codes may currently evade some defenses, security technologies will evolve to counter QR-based threats.

For now, education remains key. Regular security awareness training is essential to combat all cyber attacks, especially phishing and social engineering threats.

Top Tips for Security Awareness Training

1
Keep Training Current

Regularly review and update security training to address new threats in the ever-changing cybersecurity landscape.
2
Identify Quishing Attacks

Teach users how to spot phishing attempts, including quishing. Look for red flags like poor spelling/grammar, odd sender email addresses, and urgent action demands.
3
Guide on Response

Tailor responses to your company policies. Reporting suspicious emails to the IT department, rather than just deleting them, helps tech teams proactively defend against threats.

Why is quishing getting so common?

Quishing attacks are increasing as hackers adapt to people's growing awareness of email link risks. While users are becoming more cautious with email links, they often overlook QR codes, not recognizing them as potential threats. This gap in security awareness makes it easier for attackers to exploit QR codes, leading users to scan them without considering the security implications.

Start with the basics

In the ever-evolving cyber landscape, where hackers continually devise new ways to exploit vulnerabilities, awareness is key to protecting yourself against emerging threats. It's crucial to remember that malicious actors are always looking for unexpected ways to attack so it becomes your personal responsibility to protect your data. Even simple actions, like reading this blog, can help you avoid falling for quishing and stay safe online.

Building a multi-layered security strategy can mitigate the impact of a successful quishing attack. Start with the basics, such as obtaining Cyber Essentials certification, especially Cyber Essentials Plus. This ensures your organization has strong foundational security components. Even businesses with advanced security strategies can benefit from Cyber Essentials certification. You might even have me as your Cyber Essentials Assessor!