Quishing for trouble. [Research Saturday]

Summary

CyberWire Daily Podcast Summary Episode: "Quishing for Trouble" [Research Saturday]
Release Date: December 21, 2024
Host: N2K Networks

---

Introduction to Quishing

In the December 21, 2024 episode of CyberWire Daily, hosted by N2K Networks, cybersecurity expert Adam Kahn, Vice President of Security Operations at Barracuda, delves into the burgeoning threat of "quishing"—phishing attacks that utilize QR codes. The episode, titled "Quishing for Trouble", presents cutting-edge research on how cybercriminals are adapting to the increasing prevalence of QR codes in everyday interactions.

Overview of the Research

Adam Kahn introduces the research study, "The Evolving Use of QR Codes in Phishing Attacks," which analyzed over half a million emails from June to September 2024. The study focused on emails containing PDF attachments and embedded QR codes, identifying a significant trend in impersonation of reputable brands.

“Over half a million emails that were analyzed had PDF documents and even the emails themselves had QR codes included in them.”
— Adam Kahn [02:08]

Key Findings

The research uncovered that cybercriminals predominantly impersonate well-known brands to lend credibility to their phishing attempts. The breakdown of these impersonations is as follows:

• Microsoft: 51%
• DocuSign: 31%
• Adobe: 15%

“Microsoft was about 51% of the overall QR code attacks that we've been able to attribute to, followed by 31% to DocuSign and 15% were attributed to Adobe.”
— Adam Kahn [05:38]

Mechanisms of Quishing Attacks

Quishing attacks typically involve spoofed emails that appear to come from legitimate sources. These emails often contain urgent requests, such as verifying accounts or reactivating multi-factor authentication (MFA). The embedded QR codes, when scanned, redirect victims to malicious websites designed to harvest login credentials or distribute malware.

“They’re asking users to verify their accounts or reactivate their MFA or review or document wire DocuSign or Adobe. ... [The QR code] takes them to an actual malicious website where these attackers are able to get their login credentials or distribute malware on the mobile device.”
— Adam Kahn [05:48]

Challenges with Traditional Security Measures

One of the significant challenges highlighted is the ability of quishing attacks to bypass traditional spam filters. Since QR codes are images rather than text-based links, they can evade filters that rely on detecting suspicious URLs or domains.

“It seems to me that in some ways QR codes kind of short circuit that whole scrutiny.”
— Adam Kahn [09:26]

Advanced email protection solutions now incorporate AI and image recognition to detect and block malicious QR codes before they reach users.

“Advanced email protection software ... utilizing AI to do image recognition, when it sees images such as QR codes, it's able to block them before it reaches the user's email.”
— Adam Kahn [10:39]

Recommendations for Mitigating Quishing Threats

To combat the rising threat of quishing, Adam Kahn offers several strategic recommendations:

1. User Awareness and Training: Educate users about the dangers of quishing, emphasizing the importance of scrutinizing unexpected emails, especially those containing QR codes from unfamiliar sources.

   “Making sure the users understand what QR code phishing is, what type of tactics are utilized, and how to go about protecting against those is key.”
   — Adam Kahn [11:16]

2. Multi-Layered Email Security: Implement email security solutions that leverage AI to analyze both textual and visual content, effectively identifying and blocking malicious QR codes.

3. Enable Multi-Factor Authentication (MFA): Enforce MFA across the entire organizational infrastructure to add an extra layer of security, thereby protecting against unauthorized access even if credentials are compromised.

Conclusion

The episode underscores the evolving sophistication of phishing attacks through the use of QR codes. As QR code usage becomes more ubiquitous in daily transactions, cybercriminals are exploiting this trend to craft more convincing and harder-to-detect phishing schemes. By enhancing user education, deploying advanced security measures, and enforcing robust authentication protocols, organizations can significantly mitigate the risks posed by quishing.

“It's a new tactic and it's very clever that these cybercriminals are utilizing.”
— Adam Kahn [09:56]

Adam Kahn's insights provide a crucial understanding of the current landscape of phishing attacks and offer actionable strategies to bolster an organization's cybersecurity defenses against these innovative threats.

---

Produced by Liz Stokes, mixed by Elliot Peltzman and Trey Hester. Executive Producer: Jennifer Ibin. Executive Editor: Brandon Karp. President: Simone Petrella. Publisher: Peter Kilpe.

Transcript

[Dave Buettner]

You're listening to the Cyberwire Network powered by N2K. Do you know the status of your compliance controls right now? Like right now? We know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on.

[Adam Kahn]

Point in time checks.

[Dave Buettner]

But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off.

[Unknown Speaker]

We don't see QR codes being attached or shared but but it is becoming more prevalent in our day to day lives. When we are going to even certain restaurants, they don't even have a menu anymore, they give you a QR code. And when it comes to emails, more and more companies are trying to use QR codes, but it's a fast way to engage.

[Dave Buettner]

That's Adam Khan, VP of Security Operations at Barracuda. The research we're discussing today is titled the evolving use of QR Codes in Phishing Attacks.

[Unknown Speaker]

You know, as tactics are evolving when it comes to phishing and our researchers are always digging into how cybercriminals are advancing and utilizing new tactics and techniques. And the data that proves over, as you saw in the article, over half a million emails that were analyzed that had PDF documents and even the emails themselves had QR codes included in them. Impersonating legitimate brands such as Microsoft, including the tools within Microsoft such as SharePoint or OneDrive and even companies like DocuSign or Adobe are being utilized by these cybercriminals to execute QR phishing attacks. So obviously it's not very commonly known and it was really the data kind of resonated overall how it's kind of growing over time.

[Adam Kahn]

Well, before we dig into some of the specifics from the report, for folks who may not be familiar with this particular kind of phishing, it's often called quishing QR code phishing. I think most folks are familiar with.

[Dave Buettner]

What a QR code is at this.

[Adam Kahn]

Point, but how typically does a QR code get attached to a phishing attack?

[Unknown Speaker]

So it's obviously not a normal thing, right? We don't see QR codes being attached or shared, but it is becoming more prevalent in our day to day lives. When we are going to even certain restaurants, they don't even have a menu anymore, they give you a QR code. And when it comes to emails, more and more companies are trying to use QR codes, but it's a fast way to engage with users and get them to either buy their products or learn about some of their services. And as this is happening, cybercriminals are actually taking advantage of those tactics and being able to utilize. So yeah, it's, it's kind of becoming more and more norm publicly and now businesses are utilizing those as well.

[Adam Kahn]

Well, let's dig into the research here together. You all took a sort of an extended look at, at phishing emails that had QR codes embedded in them.

[Unknown Speaker]

Yeah, that's correct. So we actually did the research from all the way from 20, 24 and 20, from June to September's end and over, like I said, half a million emails that had PDF attachments and QR codes embedded in them. And they're impersonating legitimate brands such as Microsoft. It's a public company that a lot of people are utilizing their products and services, especially in the business sector. And it becomes an easy tactic for attackers to engage users into utilizing verbiage such as urgency to take some of those actions. And the research found that Microsoft was about 51% of the overall QR code attacks that we've been able to attribute to, followed by 31% to, to DocuSign and 15% were attributed to Adobe.

[Adam Kahn]

And what do these typically look like? I mean, are they impersonating login pages of these popular brands? How does it shape up here?

[Unknown Speaker]

Great question. So these cybercriminals are tricking victims by sending them basically a one pager document, right? Or embedding the QR code within the email itself. They're asking users to verify their accounts or reactivate their MFA or review or document wire DocuSign or Adobe. And the way it looks like you will have a message from the attacker and this could be a spoofed email that they could do, they could utilize to generate this email and they'll embed the QR code in the email itself or the attachment. And the attachment basically has, hey, this is a message from your administrator or from Microsoft, the vendor itself, asking you to verify your credentials or reactivate your mfa. And when the users are utilizing their phones, they're urged to use their phone's camera to scan the QR code, which takes them to an actual malicious website where these attackers are able to get their login credentials or distribute malware on the mobile device, or take them to a fake payment portal site.

[Dave Buettner]

We'll be right back.

[Unknown Speaker]

And now a word from our sponsor, Know before it's all connected and we're not talking conspiracy theories, we're talking when it comes to infosec tools, effective integrations can make or break your security stack. The same should be true for security awareness training. KnowBeFor, provider of the world's largest library of security awareness training, provides a way to integrate your existing security stack tools to help you strengthen your organization's security culture. KnowBe4's security coach uses standard APIs to quickly and easily integrate with your existing security products for from vendors like Microsoft, CrowdStrike and Cisco 35 vendor integrations and Counting Security Coach analyzes your security stack alerts to identify events related to any risky security behavior from your users. Use this information to set up real time coaching campaigns targeting risky users based on those events from your network, endpoint identity or web security vendors. Then coach your users at the moment the risky behavior occurs, with contextual security tips delivered via Microsoft Teams, Slack or email. Learn [e-mail] SecurityCoach that's knowbe4.com SecurityCoach and we thank knowbe4 for sponsoring our show.

[Dave Buettner]

The IT world used to be simpler.

[Unknown Speaker]

You only had to secure and manage environments that you controlled.

[Dave Buettner]

Then came new technologies and new ways to work.

[Unknown Speaker]

Now employees, apps and networks are everywhere.

[Dave Buettner]

This means poor visibility, security gaps, and added risk. That's why Cloudflare created the first ever connectivity cloud. Visit cloudflare.com to protect your business everywhere you do business.

[Adam Kahn]

You know, it's interesting when I think about the evolution of some of these attacks. You know, we've said for years, you know, never click the links. And I think we would give folks advice that, you know, if there's a link in an email or something like that, you know, hover over that link so you can see what the actual URL is beneath the text of the link. But it seems to me that in some ways QR codes kind of short circuit that kind of scrutiny.

[Unknown Speaker]

Absolutely. Yeah. It's bypassing the whole, you know, concept of embedding URLs inside, you know, some sort of image. You actually have an image which is the QR code which is taking you to another site. So it becomes very tricky for users to kind of being able to see, okay, this is a phishing email or this is something that's you know, malicious and I shouldn't engage with it. So yeah, it's definitely a new tactic and it's very clever that these cybercriminals are utilizing.

[Adam Kahn]

Does using QR codes make it easier for these messages to bypass, say, spam filters?

[Unknown Speaker]

To a certain extent it does. Right? Spam filters are basically looking at certain content in certain URLs and certain domains. But when you look at advanced email protection software, and then that's actually utilizing AI to do image recognition, when it sees images such as QR codes, it's able to block them before it reaches the user's email.

[Dave Buettner]

So what are your recommendations then based.

[Adam Kahn]

On the information you all have gathered here? How should folks go about best protecting themselves?

[Unknown Speaker]

So I think there's a couple of things users need to look at, right? So one of the first things is look at unexpected emails. Like receiving an email with a QR code from an unfamiliar email address, especially if it contains unsolicited attachment and link, is the red flag, right? You're getting it from an untrusted source. Let's say getting it from a source that you're not familiar with is another one. Promotion offers is another big thing. I know it's very tempting. Some of these QR codes that are being sent and the offers seem to be too good to be true, and they're offered, presented with a QR code to trap the user and there's again some suspicious messages that could be sent where they're asking you to take immediate action and payment. I think these all kind of fall into the user awareness and training category. So making sure the users understand what QR code phishing is, what type of tactics are utilized, and how to go about protecting against those is key. So that I would put that in one category. The other thing is utilizing a multi layer email security that leverages AI. These tactics are so advanced and like you mentioned, spam filters only are going after certain domains and certain artifacts within the email. But when you have images and AI is, as we've seen, is really good at analyzing these images, being able to decipher between a legitimate one and a malicious one. So having a multi layered security helps protect against these attacks before they reach the users themselves. And lastly, I would say I can't stress enough. There's so many organizations, Dave, that I deal with on an ongoing basis that still don't have MFA enabled across the entire infrastructure. Right. Protecting against not just QR code phishing, but against multiple attacks. So those are the three big buckets.

I would say.

[Dave Buettner]

Our thanks to Adam Kahn from Barracuda for joining us. The research is titled the Evolving Use of QR Codes in Phishing Attacks. We'll have a link in the Show Notes. That's Research Saturday, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the Show Notes or send an email to cyberwire2k.com we're privileged that N2K Cyberwire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. This episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Our executive editor is Brandon Karp. Simone Petrella is our president, Peter Kilpe is our publisher and I'm Dave Buettner. Thanks for listening. We'll see you back here next.