Hackers use new QR code phishing tactic to target organisations- Here's how the scam works

tech.hindustantimes.com:

A recent report by cybersecurity firm Check Point has uncovered a new and dangerous method of QR code phishing attacks. Hackers are now using a technique called Conditional QR Code Routing Attacks, deploying custom templates tailored to each targeted organisation, making every attack unique and highly personalised. Over the past 14 days, more than 2,000 phishing emails have been sent to over 1,100 customers, according to the report.

This phishing campaign masquerades as an authentication update, delivered via email to potential victims. The email warns recipients that their account authentication is about to expire and urges them to re-authenticate to avoid disruptions to their email service. The messages include the legitimate company logo and personalized details, adding an air of authenticity and urgency.

Upon scanning the QR code, users are redirected to a credential harvesting site. The urgency of the message, suggesting imminent email access issues, increases the likelihood that users will act quickly without verifying the legitimacy of the email.

The use of QR codes adds a layer of trust since QR codes are widely used, especially in countries like India where digital payments are prevalent. However, scanning the QR code on a mobile device can lead to serious security breaches on that device.

To protect themselves, users are advised to be cautious with emails and messages that demand urgent action or seem unusual. It's essential to verify the authenticity of the message by checking for discrepancies such as suspicious email addresses and spelling errors.

QR code phishing attacks are evolving, with hackers employing more sophisticated and targeted methods. Users must remain vigilant and skeptical of urgent requests to scan QR codes, ensuring they verify the source before taking any action. As phishing tactics become more personalized, awareness and caution are critical in preventing security breaches.