Sophos has released the findings of its X-Ops research on a new type of threat known as “quishing.”

This attack vector involves the use of fraudulent QR codes sent by threat actors via email, effectively bypassing the phishing security measures that companies have implemented.

In this scheme, a fraudulent QR code is embedded in a PDF document attached to an email. It typically contains messages related to payroll, employee benefits, or other official paperwork that a business might send to its employees. Since QR codes are not scannable by computers, employees must use their mobile phones to scan the code.

Once scanned, the QR code directs them to a phishing page that may appear legitimate, as mobile phones generally have less security compared to computers. The attackers aim to capture employees’ passwords and multi-factor authentication (MFA) tokens to access the company’s system while bypassing standard security measures.

Andrew Brandt, principal researcher at Sophos X-Ops, noted, “We spent a considerable amount of time sifting through various spam samples to identify examples of quishing. Our research indicates that attacks exploiting this specific threat vector are increasing in both volume and sophistication, particularly regarding the appearance of the PDF documents.”

In addition to employing social engineering tactics, the quality of emails, attachments, and QR code images in these attacks is also improving. Furthermore, some malicious actors are organizing their efforts by offering as-a-service tools to conduct phishing campaigns using fraudulent QR codes.

These services often include features such as CAPTCHA bypasses and IP address proxies designed to evade automated threat detection. These criminal organisations have developed sophisticated phishing platforms capable of capturing the credentials or MFA tokens of targeted individuals.