top of page
  • Writer's pictureJacob Alcock

QR code phishing: the rising threat and Microsoft's response

A rising threat has surfaced in the ever-evolving landscape of cyber threats, catching many businesses off-guard. Scammers can use QR code phishing campaigns, frequently sent via email, with links to malicious content. 


This innovative method bypasses conventional online detection systems, enticing victims with seemingly legitimate prompts like password resets or two-factor authentication requests.



Understanding QR codes

QR codes are two-dimensional barcodes that store information, such as URLs or contact details. They can be scanned with smartphones or other camera-equipped devices, often directing users to websites or apps. 


Hackers disguise these QR codes to appear legitimate. Once scanned, they can redirect to phishing sites or initiate malware downloads. The limited screen size of mobile devices exacerbates the issue, making it harder for users to recognise red flags.


The considerable danger here is that users cannot see what links or online apps are being opened when they scan the code. By the time they realise that it’s malicious content, it’s often too late. 


Why are QR codes used for phishing?

  1. Device shift: These codes move the attack from secured corporate systems to potentially less secure personal devices like mobile phones. 

  2. Credential theft: They exploit the most common vector - the URL but in a less detectable form.


You can view an example below of an attempt from a Facebook impersonation where the user is given a QR code to secure their account.



The role of Microsoft Defender for Office 365

Recognising the threat, as of yesterday, Microsoft has now enhanced its Defender for Office 365 to combat QR code phishing effectively. 


Here's how:

  • Image detection: Advanced image extraction technologies detect QR codes in emails, extracting URL metadata for analysis.

  • Threat signals analysis: A combination of various mail flow signals, including QR code detection, feeds into machine learning algorithms for a robust threat assessment.

  • URL analysis: URLs extracted from QR codes undergo scrutiny through machine learning models and reputation checks. For higher-tier licenses, sandboxing is employed for deeper investigation.

  • Heuristic-based rules: Microsoft uses these rules to adapt swiftly to evolving attack patterns, efficiently blocking malicious QR code phishing emails.


Impact and results


Additional protection measures

  • Extended Detection and Response (XDR): Offers comprehensive defence, including account identity protection.

  • Endpoint Protection: Anti-phishing capabilities for mobile devices, blocking access to phishing sites.

  • End-User Training: Attack Simulation Training helps users identify and respond to phishing attacks, including QR code-based threats.


Staying vigilant

As QR code phishing represents a shift in tactics, it's crucial to remain cautious and vigilant. Always verify the legitimacy of the email and its contents before acting. Regularly review policies and configurations and utilise Microsoft's resources to maintain a secure posture.


Book a 1-2-1 call with Niomie to find out more about what you can do about phishing.


 

 


How can we support your business?

Phishing 292 x 219px.png

Raise your staff's awareness of phishing emails and guard your business against the growing trend of social-engineering threats.

 

Training your employees on what a phishing attack looks like makes them more likely to identify and report scams.

security awareness training.png

Our training package is designed and delivered by cyber experts giving you access to the most up-to-date information in an ever-changing cyber landscape.

You can purchase single-place training spots or a cyber security workshop.

Community Members

Our premium membership package is aimed at medium-sized businesses and includes bespoke security awareness training sessions.

 

This allows your business to train several cyber security champions and an assessment of your cyber risk. 

bottom of page