Security researchers at Check Point have discovered a new type of QR code phishing (called “quishing”) that attackers use to cleverly bypass OCR systems.
By sending the infected QR codes in their phishing emails as image files instead of the usual ones, the masterminds use ASCII characters to recreate the characteristic black tiles of standard QR codes. These are difficult to distinguish from legitimate QR codes at first glance, but can be scanned like regular codes and converted into accessible - and in this case infected - URLs.
The aim is OCR security analyses
Optical character recognition (OCR) is not only used for digitizing text and writing, but is also used in IT security. The technology helps monitor documents and communication channels and can support the early detection of malicious activities and compliance with data protection regulations. Machine learning is often used for this. Check Point has now uncovered a new campaign in which a QR code is not displayed as an image, but using ASCII characters and HTML in order to bypass the OCR scanning and filtering systems mentioned. The researchers intercepted over 600 such emails at the end of May alone.
Essentially, threat actors insert small blocks into the HTML code. In the email, this looks like a normal QR code to the recipient, but it contains a phishing link. However, an OCR system sees this as a normal string of characters, allowing the email to pass through the filter and reach its victim unhindered. There are websites that help threat actors generate these codes automatically, and they can be configured to contain malicious links.
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthThe researchers have discovered another example of a fake QR code that was created to bypass multi-factor authentication (MFA) and was also embedded in a phishing email that came from a supposed administrator. Since July 2023, the security researchers have been observing the new phishing methods using QR codes, which have recently increased dramatically. In February of this year, they registered over 10.000 attacks using QR codes - an increase of 1.688 percent compared to January. In March, there were already over 30.000 attacks, in April the number briefly fell again to around 10.000 and in May rose again dramatically to over 35.000 attacks. This is probably also attributable to the new methods.
QR Code Phishing 3.0 and OCR
Cybercriminals' attack methods are constantly evolving and QR code phishing is no exception. What is remarkable, however, is how quickly these developments are currently happening. It started with standard MFA verification codes. These were quite simple and asked users to scan a code to either reset MFA or even view financial data.
The second variant, QR code phishing 2.0, was a conditional routing attack. The link detects where the user interacts with it and adapts accordingly to appear more authentic. If the user is on a Mac, a different link is displayed than if the user is using an Android phone. Check Point has also seen custom QR code campaigns where the hackers dynamically insert the company's logo and even the correct username as the addressee.
QR code phishing 3.0 is now turning out to be a manipulation campaign. It is not a traditional QR code, but a text-based representation of one. This makes it much more difficult for OCR systems to see and recognize it. It also shows how the threat actors are adapting. Many email security solution providers have recently introduced new QR code protection using a form of OCR. Hackers know this and have tailored their campaigns accordingly. This may just be the next evolutionary phase in the eternal cat-and-mouse game of cybersecurity: hackers find gaps, defenders close them - then the cycle starts again. But you are not defenseless against these new scams. IT managers should implement security measures that
- QR codes embedded in emails automatically decrypt and analyze the URLs for malicious content.
- embedded QR codeRewrite s in the email text and replace them with a secure, rewritten link.
- advanced artificial intelligence to detect several indicators of phishing.
About check point Check Point Software Technologies GmbH (www.checkpoint.com/de) is a leading provider of cybersecurity solutions for public administrations and companies worldwide. The solutions protect customers from cyberattacks with an industry leading detection rate for malware, ransomware and other types of attacks. Check Point offers a multi-level security architecture that protects company information in cloud environments, networks and on mobile devices, as well as the most comprehensive and intuitive “one point of control” security management system. Check Point protects over 100.000 businesses of all sizes.
Matching articles on the topic