A new generation of malicious QR codes

Barracuda researchers have discovered a new generation of malicious QR codes used for phishing attacks (quishing). These new techniques are designed to bypass traditional security measures, including optical character recognition (OCR).

New phishing attacks use QR codes based on ASCII/Unicode text characters, rather than traditional static images. This allows them to avoid detection by OCR systems, since the code appears to such systems as a meaningless set of characters. Another approach involves using Universal Resource Identifiers (URIs) to create hard-to-detect phishing pages based on binary blobs. This method avoids URL filtering and crawling because blob-URIs do not download data from external servers and are therefore less vulnerable to traditional security tools.

Classic QR phishing attacks involve embedding malicious links into the QR code itself, which can be detected by security tools. However, new techniques aim to disable or complicate such systems by making the code “unreadable” by crawlers or by using dynamic URIs that are difficult to track. According to Barracuda research, in 2023 one in 20 mailboxes will be attacked using QR codes. A new generation of malicious QR codes poses serious challenges to traditional security systems.

A new generation of phishing attacks using QR codes (quishing) makes it difficult for traditional security systems to detect threats.