Home / Technology / QR Code Scams Bypass MFA, Steal Data
QR Code Scams Bypass MFA, Steal Data
13 Jul
Summary
- QR code phishing attacks have increased by 25% year-over-year.
- Attackers use QR codes to bypass multi-factor authentication defenses.
- Scanning unexpected QR codes can lead to data theft and account compromise.
A new wave of cyberattacks, known as quishing or QR code phishing, is emerging as a significant threat. These attacks weaponize QR codes to bypass multi-factor authentication (MFA) and compromise user accounts. Attackers embed malicious links within QR codes, often sent via email or found in attachments, to lure victims into scanning them.
Once scanned, users are directed to spoofed websites that mimic legitimate services, aiming to steal login credentials and session tokens. This tactic effectively bypasses MFA because users believe they are interacting with a trusted domain. Microsoft Defender has noted a substantial rise, with QR code-based campaigns now comprising up to 30% of total phishing efforts.
Security experts emphasize that QR codes, like email links, should be treated with suspicion, especially if unexpected. The increasing prevalence of quishing, including physical instances on posters, highlights the need for vigilance. Users are advised to manually navigate to official websites or use trusted apps instead of scanning unknown QR codes to protect against data theft and account hijacking.
