{"id":208735,"date":"2025-09-03T09:47:52","date_gmt":"2025-09-03T13:47:52","guid":{"rendered":"https:\/\/nationalcybersecuritysociety.org\/?p=208735"},"modified":"2025-11-14T09:25:11","modified_gmt":"2025-11-14T14:25:11","slug":"ctw-4-february-2024","status":"publish","type":"post","link":"https:\/\/nationalcybersecuritysociety.org\/?p=208735","title":{"rendered":"CTW #4 \u2014 February 2024"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” custom_padding=”||0px|||”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/NCSS-3397-Bulletin-Header-Footer-Header-Graphic-1600×350-Compressed.png” title_text=”NCSS-3397-Bulletin-Header-Footer-Header Graphic 1600×350-Compressed” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Published: February 16, 2024<\/em><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Our new bulletin Cyber Threat Watch<\/em><\/strong> has been created to help small businesses stay up to date on the latest threats, news, and events affecting their business. The content has been curated to make cybersecurity easy and accessible for both technical and nontechnical readers.<\/span><\/p>\n

[\/et_pb_text][et_pb_heading title=”Featured Cyber Threat \u2014Quishing (QR Code Phishing)” _builder_version=”4.27.4″ _module_preset=”default” title_level=”h2″ title_font=”|600|||||||” title_text_color=”#00688E” global_colors_info=”{}”][\/et_pb_heading][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_701494816-scaled.jpeg” title_text=”AdobeStock_701494816″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_3_text_color=”#00688E” global_colors_info=”{}”]<\/p>\n

In the dynamic landscape of cyber threats, organizations grapple with persistent challenges posed by unwanted emails and the growing threat of <\/span>phishing attacks. As cybercriminals innovate tactics, one notable trend has surfaced: quishing<\/em>. This is a form of phishing through QR codes by replacing the traditional way of using malicious uniform resource locators (URLs) with QR codes in email communications.<\/p>\n

How Quishing Works<\/h3>\n

In phishing attacks, cybercriminals aim to steal login credentials or valuable information by setting up fraudulent websites that mimic secure platforms. Quishing extends this strategy by replacing such traditional hyperlinks with QR codes, challenging security systems\u2019 ability to analyze QR code contents effectively.<\/p>\n

Without suspecting, email recipients may unintentionally scan QR codes embedded within the email body\u2014t<\/span>his poses challenges for traditional email security systems, relying on recipients to understand the threat and avoid falling victim as they potentially lack the capability to extract and inspect URLs from QR codes.<\/p>\n

[\/et_pb_text][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_564952389-scaled.jpeg” title_text=”Concept of using smartphones to scan QR codes to make payment. Customer making payment through mobile phone and scan code for online shopping. Use of technology in the daily life of modern people.” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_3_text_color=”#00688E” custom_css_free_form=”ol {|| list-style: none !important; || counter-reset: item; ||}||||ol li {|| counter-increment: item; || position: relative; || padding-left: 2em; \/* Adjust as needed for spacing *\/||}||||ol li::before {|| content: counter(item) %22.%22; || font-weight: bold; || position: absolute;|| left: 0; || width: 1.5em; || text-align: right;||}” global_colors_info=”{}”]<\/p>\n

Protection Strategies<\/h3>\n

To mitigate the potential risk posed by quishing, it is recommended that organizations take the following approach:<\/p>\n

    \n
  1. Employee Training:\u00a0
    <\/strong>– Educate employees about the new form of phishing attacks using QR codes
    – Foster a vigilant workforce capable of recognizing malicious emails
    – Establish a reporting process to notify IT personnel for prompt risk mitigation<\/li>\n
  2. Technological Measures:
    <\/strong>– Use email security systems to scan for known malicious URLs
    – Extend this capability to URLs encoded within QR codes
    – Monitor the Internet websites for fraudulent websites and take them offline by employing services such as Digital Risk Protection<\/a><\/span> (DRP)<\/li>\n<\/ol>\n

    Caution: QR Code Scanning on Mobile Devices<\/h3>\n

    When using mobile devices such as a cellphone or tablet to scan QR codes, exercise caution by adopting the following practices:<\/p>\n

      \n
    1. <\/strong>Use the QR Code Scanner App:
      <\/strong>– Consider using reputable QR code scanner apps that come with security features. Some apps offer built-in URL scanning, allowing users to preview the destination URL or content before opening.<\/span><\/li>\n
    2. <\/strong>Check the Domain:
      <\/span><\/strong>– Hover your device\u2019s camera over a QR code without scanning\u2014your device may display the destination URL. Verify that the domain is legitimate and matches the official website of the entity it claims to be associated with.<\/span><\/li>\n
    3. <\/strong>Inspect the Design:
      <\/strong>– Beware of unsolicited QR codes by checking over noticeable design flaws or inconsistent branding. Legitimate codes often have a consistent design that aligns with the provided context.<\/span><\/li>\n
    4. <\/strong>Verify Through Official Channels:
      <\/span><\/strong>– Check official websites to verify the authenticity of QR codes. If the QR code is associated with a product or event, visit the official support channels to confirm the legitimacy of the code.<\/span><\/li>\n
    5. <\/strong>Be Skeptical:
      <\/span><\/strong>– Avoid scanning codes from unknown or suspicious sources. Stay informed about new phishing tactics and refrain from scanning if in doubt. Vigilance is key in protecting against malicious content associated with QR codes.<\/span><\/span><\/li>\n<\/ol>\n

      In conclusion, the rise of quishing necessitates organizations to update their cybersecurity strategies. A holistic approach, encompassing employee training with the robust reporting process and technological proactive measures, can effectively reduce the risks associated with this emerging threat.<\/p>\n

      The NCSS encourages businesses to adopt comprehensive security practices and stay informed about evolving threats. We recommend you leverage a managed security service provider (MSSP). We have partners who can help, here<\/a>. For more information, visit our Small Business page<\/a><\/span>.<\/p>\n