I hate to say, “I told you so,” but I did. I have repeatedly warned against scanning QR codes. Following the pandemic and scanning QR codes at restaurants, people have become very comfortable with scanning QR codes, don’t think twice about it, and don’t fully grasp the risk associated with a malicious QR code. 

It is important to understand that just like malicious code embedded in a link or an attachment in an email or text (which we have been trained not to click on), a threat actor can embed malicious code into a QR code with the same results. Unfortunately, they are starting to do just that.

According to Dark Reading threat actors recently “sent more than 1,000 emails armed with malicious QR codes aimed at stealing Microsoft credentials” to an energy company, and other industries, including manufacturing, insurance, technology, and financial services.

The email phishing campaign with malicious QR codes was discovered by Cofense. According to Cofense, “This campaign makes use of a PDF or image file attachment with the QR code embedded into it… This makes it easier for the emails to bypass Secure Email Gateways.” The campaign is ongoing and “spreading quickly.” The bottom line is to train employees not to scan QR codes, received by email or text, and to alert the IT department if one is received. Everyone should treat QR codes with a high degree of suspicion, just like a suspicious text or email.