QR codes have become an integral part of our daily lives. Many applications use them for identity verification (e.g., in Poland, to confirm identity through the mObywatel application). We also encounter them in restaurants (they facilitate access to electronic menus, which became popular during the pandemic and is convenient, especially abroad, allowing for easy translation, and is also more environmentally friendly by reducing printing).

Unfortunately, QR codes can be a serious attack vector. The ease with which they can be swapped or placed on unsuspecting posters is concerning. Furthermore, we cannot directly verify the URL hidden under the code. We are often trained to spot subtle inconsistencies, such as swapping a capital „i” for a lowercase „L,” but this is impossible with QR codes.

An example of a phishing campaign using QR codes was an email sent out by cybercriminals impersonating the Microsoft team. The message informed the recipient that their account login would expire soon (within 72 hours) and instructed them to scan the QR code to confirm their identity and avoid being blocked.

Source: https://iodo-poznan.pl/quishing-nowe-zagrozenie-w-cyberprzestrzeni