{"id":38547,"date":"2023-08-22T15:13:46","date_gmt":"2023-08-22T15:13:46","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=38547"},"modified":"2023-08-22T15:13:51","modified_gmt":"2023-08-22T15:13:51","slug":"attackers-weaponizing-qr-codes","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/","title":{"rendered":"Attackers Weaponizing QR Codes to Steal Employees Microsoft Credentials"},"content":{"rendered":"\n

A recent discovery highlights a significant QR code<\/a> phishing campaign that targets Microsoft credentials across various industries. <\/p>\n\n\n\n

Notably, a major energy company based in the US is at the forefront of this attack, underscoring the importance of robust security practices<\/a> to combat evolving threats. <\/p>\n\n\n\n

This article provides an in-depth analysis of the campaign, its targets, tactics, and potential countermeasures.<\/p>\n\n\n\n

The Rise of QR Code Phishing<\/strong><\/h2>\n\n\n\n

Since May 2023, Cofense, a phishing detection company, has been tracking<\/a> a sophisticated phishing campaign leveraging QR codes to dupe users into compromising their Microsoft credentials.\u00a0<\/p>\n\n\n\n

The campaign’s most prominent victim is a major US energy company, accounting for nearly 29% of the over 1000 malicious QR code<\/a> emails observed. <\/p>\n\n\n\n

Other industries affected include manufacturing, insurance, technology, and financial services, with 15%, 9%, 7%, and 6% of campaign traffic, respectively.\u00a0<\/p>\n\n\n\n

These QR codes contain phishing links or redirects disguised as Microsoft security<\/a> notifications.<\/p>\n\n\n\n

Unmasking the QR Code Campaign<\/strong><\/h2>\n\n\n\n

The campaign methodology involves sending emails with PNG or PDF attachments that prompt users to scan QR codes. <\/p>\n\n\n

\n
\"Security<\/figure><\/div>\n\n
\n
\"Major<\/figure><\/div>\n\n
\n
\"Security<\/figure><\/div>\n\n
\n
\"Multi-Factor
          QR Code Image Samples<\/em><\/figcaption><\/figure><\/div>\n\n\n

Unlike traditional phishing links, QR codes are more likely to reach inboxes, as the phishing link is concealed within the QR image.\u00a0This image is then embedded within an attachment, often a PNG or PDF file.\u00a0<\/p>\n\n\n\n

This covert delivery method aims to bypass security filters and exploit user curiosity.<\/p>\n\n\n\n

Implications for Enterprises<\/strong><\/h2>\n\n\n\n

The campaign’s focus on targeting a major energy company underscores the gravity of the threat. <\/p>\n\n\n\n

An alarming trend is the campaign’s remarkable growth rate, with an average month-to-month increase of over 270%. <\/p>\n\n\n\n

A significant portion of the campaign employs Bing redirect URLs, exploiting the legitimacy of this Microsoft-owned domain. <\/p>\n\n\n

\n
\"\"\/
                    Bing Redirect URL <\/em><\/figcaption><\/figure><\/div>\n\n\n

However, the use of domains, including krxd[.]com (associated with Salesforce) and cf-ipfs[.]com (Cloudflare’<\/a>s Web3 services), indicates a sophisticated attempt to abuse trusted domains for malicious purposes. <\/p>\n\n\n\n

Despite the Energy company being the primary target, the energy sector as a whole witnessed a major focus within the phishing campaign, signifying a broader industry-centric approach.<\/p>\n\n\n\n

Although modern mobile devices provide some level of QR code verification, user education remains crucial. <\/p>\n\n\n\n

Employees should be trained not to scan QR codes<\/a> in emails and to exercise caution when interacting with unfamiliar content.\u00a0<\/p>\n\n\n\n

Security teams should explore automation tools like QR scanners and image recognition to detect and block malicious QR codes.\u00a0<\/p>\n\n\n\n

Keep informed about the latest Cyber Security News by following us on GoogleNews<\/a>, Linkedin<\/a>, Twitter<\/a>, and Facebook<\/a>.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

A recent discovery highlights a significant QR code phishing campaign that targets Microsoft credentials across various industries.  Notably, a major energy company based in the US is at the forefront of this attack, underscoring the importance of robust security practices to combat evolving threats.  This article provides an in-depth analysis of the campaign, its targets, […]<\/p>\n","protected":false},"author":22,"featured_media":38552,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp","fifu_image_alt":"Mass phishing campaign utilizing QR codes to Steal Employees Microsoft credentials","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11,34,38],"tags":[144,149,151],"class_list":{"0":"post-38547","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security-news","8":"category-microsoft","9":"category-phishing","10":"tag-cyber-attack","11":"tag-cyber-security","12":"tag-cyber-security-news"},"yoast_head":"\nAttackers Weaponizing QR Codes to Steal Microsoft Credentials<\/title>\n<meta name=\"description\" content=\"A recent discovery highlights a significant QR code phishing campaign that targets Microsoft credentials across various industries.\u00a0\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Attackers Weaponizing QR Codes to Steal Employees Microsoft Credentials\" \/>\n<meta property=\"og:description\" content=\"A recent discovery highlights a significant QR code phishing campaign that targets Microsoft credentials across various industries.\u00a0\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Security News\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hackingtutorialsandnews\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-22T15:13:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-08-22T15:13:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp\" \/>\n<meta name=\"author\" content=\"Sujatha\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp\" \/>\n<meta name=\"twitter:creator\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:site\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sujatha\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Attackers Weaponizing QR Codes to Steal Microsoft Credentials","description":"A recent discovery highlights a significant QR code phishing campaign that targets Microsoft credentials across various industries.\u00a0","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/","og_locale":"en_US","og_type":"article","og_title":"Attackers Weaponizing QR Codes to Steal Employees Microsoft Credentials","og_description":"A recent discovery highlights a significant QR code phishing campaign that targets Microsoft credentials across various industries.\u00a0","og_url":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/","og_site_name":"Cyber Security News","article_publisher":"https:\/\/www.facebook.com\/Hackingtutorialsandnews","article_published_time":"2023-08-22T15:13:46+00:00","article_modified_time":"2023-08-22T15:13:51+00:00","og_image":[{"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp","type":"","width":"","height":""}],"author":"Sujatha","twitter_card":"summary_large_image","twitter_image":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp","twitter_creator":"@The_Cyber_News","twitter_site":"@The_Cyber_News","twitter_misc":{"Written by":"Sujatha","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/#article","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/"},"author":{"name":"Sujatha","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/8cce0074db194b2ee16091454d02e618"},"headline":"Attackers Weaponizing QR Codes to Steal Employees Microsoft Credentials","datePublished":"2023-08-22T15:13:46+00:00","dateModified":"2023-08-22T15:13:51+00:00","mainEntityOfPage":{"@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/"},"wordCount":454,"publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"image":{"@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp?w=1600&resize=1600,900&ssl=1","keywords":["cyber attack","cyber security","cyber security news"],"articleSection":["Cyber Security News","Microsoft","Phishing"],"inLanguage":"en-US","copyrightYear":"2023","copyrightHolder":{"@id":"https:\/\/cybersecuritynews.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/","url":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/","name":"Attackers Weaponizing QR Codes to Steal Microsoft Credentials","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/#primaryimage"},"image":{"@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp?w=1600&resize=1600,900&ssl=1","datePublished":"2023-08-22T15:13:46+00:00","dateModified":"2023-08-22T15:13:51+00:00","description":"A recent discovery highlights a significant QR code phishing campaign that targets Microsoft credentials across various industries.\u00a0","breadcrumb":{"@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/#primaryimage","url":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp?w=1600&resize=1600,900&ssl=1","contentUrl":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp?w=1600&resize=1600,900&ssl=1","width":"1600","height":"900","caption":"Mass phishing campaign utilizing QR codes to Steal Employees Microsoft credentials"},{"@type":"BreadcrumbList","@id":"https:\/\/cybersecuritynews.com\/attackers-weaponizing-qr-codes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cybersecuritynews.com\/"},{"@type":"ListItem","position":2,"name":"Attackers Weaponizing QR Codes to Steal Employees Microsoft Credentials"}]},{"@type":"WebSite","@id":"https:\/\/cybersecuritynews.com\/#website","url":"https:\/\/cybersecuritynews.com\/","name":"Cyber Security News","description":"World's #1 Premier Cybersecurity and Hacking News Portal","publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybersecuritynews.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cybersecuritynews.com\/#organization","name":"Cyber Security News","url":"https:\/\/cybersecuritynews.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/","url":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","contentUrl":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","width":200,"height":200,"caption":"Cyber Security News"},"image":{"@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hackingtutorialsandnews","https:\/\/x.com\/The_Cyber_News","https:\/\/www.linkedin.com\/company\/cybersecurity-news\/"]},{"@type":"Person","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/8cce0074db194b2ee16091454d02e618","name":"Sujatha","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/5fa87f276739794e0657ff36f2573aad51d58244e15af0dd685df643b5914c5b?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5fa87f276739794e0657ff36f2573aad51d58244e15af0dd685df643b5914c5b?s=96&d=mm&r=g","caption":"Sujatha"},"description":"Sujatha is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under her belt in Cyber Security, she is covering Cyber Security News, technology and other news.","sameAs":["https:\/\/cybersecuritynews.com\/","https:\/\/www.linkedin.com\/in\/sujatha-dhandapani-5a0190190"],"url":"https:\/\/cybersecuritynews.com\/author\/sujatha\/"}]}},"jetpack_featured_media_url":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8v2eWpjmpmCLvOrn4VOzdZZWmLv7ompuSRqNmNdGH-devVH2iBGd9OaZAEy4cNg8qovUOomP-ewu2XXWF3jidaCCq2e1-zpWXaj5v5cW13nY623QVeAqkcEvshRwS6WGATdRejwRJ2AMi1kfyjjmiMz8RoXmFQmoXBZmxCNPImLS1YMHvkSsaCsA-r7wA\/s1600\/SEIKO%20Data%20Breach(4)-1.webp?w=1600&resize=1600,900&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/38547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/comments?post=38547"}],"version-history":[{"count":5,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/38547\/revisions"}],"predecessor-version":[{"id":38574,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/38547\/revisions\/38574"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media\/38552"}],"wp:attachment":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media?parent=38547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/categories?post=38547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/tags?post=38547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}