Rewterz Threat Alert – Phishing Campaign Exploits QR Codes To Bypass Security Controls

Severity

Medium

Analysis Summary

A new phishing campaign used to trick users. This campaign exploits QR codes to evade security measures. The new phishing campaign makes use of QR Codes instead of the conventional method of using malicious URLs. This technique aids the attackers to elude URL analysis by various products.

The phishing attack begins after an email with the subject line “Review Important Document” reaches the victim’s mailbox. The email appears as a usual SharePoint email, which bears a QR code in the message body. The recipient then needs to scan the QR code to view the supposed document.

This embedded image with the QR code actually contains the URL to the malicious site. When the victim scans this code via their smartphone, the URL then opens on the victim’s smartphone. (Most recent smartphones directly open web links in the default phone browser.) The victim then sees a fake SharePoint website asking to log in via AOL, Microsoft, or any other account.

And this is it. When the user enters their login credentials, the attackers seamlessly get the username and password to misuse in any preferred manner.

Impact

• Credential theft
• Exposure of sensitive information

Indicators of Compromise

Email Subject

Review Important Document

Remediation

• Always be suspicious about emails sent by unknown senders.
• Never click on the link/ attachments sent by unknown senders.