{"id":49388,"date":"2023-10-20T09:00:08","date_gmt":"2023-10-20T13:00:08","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=49388"},"modified":"2023-10-23T09:00:18","modified_gmt":"2023-10-23T13:00:18","slug":"qr-codes-in-phishing-emails","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/qr-codes-in-phishing-emails\/49388\/","title":{"rendered":"Received an email with a QR code? Watch out!"},"content":{"rendered":"

There\u2019ve been more and more cases<\/a> of users receiving emails seemingly from large internet companies (for example, Microsoft or its cloud service Office 365) containing QR codes. The body of these emails have a call to action: in a nutshell, scan the QR code to maintain access to your account. This post examines whether it\u2019s worth reacting to such messages.<\/p>\n

Scan the QR code, or face the inevitable<\/h2>\n

A typical email of this kind contains a notification saying your account password is about to expire, after which you\u2019ll lose access to your mailbox, and so the password must be changed for which you need to scan the QR code in the email and follow the instructions.<\/p>\n

\"Example<\/a>

The password must be reset by scanning the QR code<\/p><\/div>\n

Another email could warn the recipient that their \u201cauthenticator session has expired today\u201d. To avoid this, the user is advised to \u201cquickly scan the QR Code below with your smartphone to re-authenticate your password security\u201d. Otherwise access to the mailbox could be lost.<\/p>\n

\"Example<\/a>

\u201cAuthenticator session has expired\u201d \u2014 for a quick fix, scan the QR code<\/p><\/div>\n

A further example: the message kindly informs the reader: \u201cThis email is from a trusted source\u201d \u2014 we\u2019ve already talked about why emails stamped \u201cverified\u201d should be treated with caution<\/a>. The thrust of the message is that \u201c3 important emails\u201d supposedly cannot be delivered to the user due to lack of some kind of validation. Of course, scanning the QR code below will \u201cfix\u201d the issue.<\/p>\n

\"Example<\/a>

Important emails can be delivered only by scanning the QR code for \u201cvalidation\u201d<\/p><\/div>\n

Clearly, the authors of these emails want to intimidate inexperienced users with high-sounding words.<\/p>\n

They\u2019re also likely hoping that the recipient has heard something about authenticator apps \u2014 which do indeed use QR codes \u2014 so that their mere mention may stir some vague associations in their mind.<\/p>\n

What happens if you scan the QR code in the email<\/h2>\n

The link in the QR code takes you to a rather convincing replica of a Microsoft login page.<\/p>\n

\"Scanning<\/a>

Scanning the QR code takes you to a phishing site that steals entered credentials<\/p><\/div>\n

Of course, all credentials entered on such phishing pages end up in cybercriminal hands. And this jeopardizes the accounts of users who fall for such tricks.<\/p>\n

An interesting detail is that some phishing links in QR codes lead to IPFS resources. IPFS (InterPlanetary File System) is a communication protocol for sharing files that has much in common with torrents. It allows you to publish any files on the internet without domain registration, hosting, or other complications.<\/p>\n

In other words, the phishing page is located directly on the phisher\u2019s computer and is accessible via a link through a special IPFS gateway. Phishers use the IPFS protocol<\/a> because it\u2019s much easier publish and much harder to remove a phishing page than blocking a \u201cregular\u201d malicious website. As such, the links live longer.<\/p>\n

How to guard against phishing QR codes<\/h2>\n

No decent authentication system will suggest scanning a QR code as your only<\/em> option. Therefore, if you receive an email asking you to, say, confirm something, or sign in to your account again, or reset your password, or perform some similar action, and this email only contains a QR code, you\u2019re probably dealing with phishing. You can safely ignore and delete such an email.<\/p>\n

And for those times when you need to scan a QR code of an unknown source, we recommend our security solution<\/a> with its secure QR code scanner function. It will check the contents of QR codes and warn you if there\u2019s anything bogus inside.<\/p>\n\n","protected":false},"excerpt":{"rendered":"

Examples of how QR codes in emails are used for phishing.<\/p>\n","protected":false},"author":2598,"featured_media":49389,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2683],"tags":[19,936,38,76,1557,97,4480,422],"class_list":{"0":"post-49388","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-email","9":"tag-kaspersky-qr-scanner","10":"tag-microsoft","11":"tag-phishing","12":"tag-qr-codes","13":"tag-security-2","14":"tag-signs-of-phishing","15":"tag-threats"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/qr-codes-in-phishing-emails\/49388\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/qr-codes-in-phishing-emails\/26505\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/qr-codes-in-phishing-emails\/21938\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/qr-codes-in-phishing-emails\/11130\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/qr-codes-in-phishing-emails\/29207\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/qr-codes-in-phishing-emails\/26785\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/qr-codes-in-phishing-emails\/26789\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/qr-codes-in-phishing-emails\/29273\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/qr-codes-in-phishing-emails\/28118\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/qr-codes-in-phishing-emails\/36431\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/qr-codes-in-phishing-emails\/11808\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/qr-codes-in-phishing-emails\/21125\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/qr-codes-in-phishing-emails\/21908\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/qr-codes-in-phishing-emails\/30612\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/qr-codes-in-phishing-emails\/27089\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/qr-codes-in-phishing-emails\/32795\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/qr-codes-in-phishing-emails\/32444\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/qr-codes\/","name":"QR codes"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/49388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2598"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=49388"}],"version-history":[{"count":6,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/49388\/revisions"}],"predecessor-version":[{"id":49403,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/49388\/revisions\/49403"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/49389"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=49388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=49388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=49388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}