New techniques help malicious QR codes evade detection

Threat researchers at Barracuda have uncovered two new techniques being used by cyber attackers to help malicious QR codes evade detection in ‘quishing’ attacks. Quishing is a form of phishing that involves the use of QR codes embedded with malicious links that, when scanned, redirect victims to fake websites designed to steal their credentials or other sensitive information. Analysts have found the techniques in attacks by leading phishing-as-a-service (PhaaS) kits Tycoon and Gabagool. The Gabagool attackers were implementing split QR codes in a fake Microsoft ‘password reset’ scam. This technique involves splitting the QR code into two separate images and… [Continue Reading]