# **Unmasking the Quishing Attack: Protecting Your Digital Identity**.


Imagine a world where innocent and inconspicuous patterns hold a secret ready to strike when you least expect it. In our era **Quick Response Codes**, also known as **QR codes** have become a part of our everyday lives. They can be found on products, flyers, menus and even tombstones.

However beneath their appearance lies a vulnerability that cybercriminals have mastered in order to carry out attacks, with precision. Welcome to the realm of QR code attacks where these looking square patterns can act as **Trojan** horses in the digital world unleashing a Pandoras box of cyber threats and security breaches.

Join us on this exploration into the hidden perils of QR codes as we reveal the tactics used by attackers discuss the consequences they bring about and explore countermeasures in this modern day cyber warfare. Lets uncover the lurking danger beneath each pixel one step, at a time.

# What is Quishing Attack

Quishing is a combination of “QR” and “phishing.” In a quishing attack, cybercriminals use a QR code to direct users to a fake website.

Cybercriminals often use social engineering techniques on the fake website to manipulate users into giving away their personal information, such as their name, address, phone number, or financial details.

This information can be used to commit fraud or identity theft. ......😬

# How Quishing Attack Work?..🤔

In order to execute quishing attacks, cybercriminals require the actual QR code. This can be easily created and linked to a phishing website. The malicious QR code is then included in a phishing email, which tricks the recipient into scanning it under the pretense of accessing important information.


🤔.......... Is that all QR codes are Vulnerable.......🤔

There are Two types of QR codes
1. Static QR codes
2. Dynamic QR codes.

Do you know what is the **Static** and **Dynamic** QR codes? don't google it 🤭 i will explain🤗.

**Static QR codes :**
* Static QR codes are fixed and contain a set amount of information that does not change over time.
* They are typically used for basic information such as website URLs, contact details, or simple text information.
* Once generated, the data encoded in a static QR code remains the same until the QR code itself is regenerated. This means that if you want to update the information, you need to create a new QR code.
* Static QR codes are suitable for situations where the content does not need to be frequently updated, and they are easier to generate because they don't require a server or database to manage dynamic data.

**Dynamic QR codes :**
* Dynamic QR codes are more versatile and can contain changing or updatable information.
* They are typically used for scenarios where the content needs to be dynamic and may change regularly, such as ticketing, payment processing, and inventory tracking.
* Dynamic QR codes are created and managed through a server or a web application. The QR code itself contains a link to a server that retrieves the current information when the code is scanned.
* This means that you can update the content associated with a dynamic QR code without changing the code itself. For example, you can change the destination URL, update product details, or modify contact information without needing to generate a new QR code.
* Dynamic QR codes offer more flexibility and are suitable for applications where real-time updates are required.

I think you have an idea which QR codes are more Vulnerable...😊(Dynamic)

# Real Time Examples for Quishing Attacks:

"You are browsing many websites on the internet to gather information; are you browsing secure websites?"(maybe no🥹)

Recently I read an Article about a Quishing mail from the mulicious Threat actors impersonate Microsoft 365 and alert the end user about their “network password” that has expired.
The message encourages the recipient to scan the QR code using their mobile camera for “connecting” MFA method to their Microsoft account. The sender’s name and email subjects were altered to fit the target company.


In the above image we see the mulicious QR code that open Microsoft look-alike page that automatically redirects them to a fake login page aimed to steal their account credentials.

# Preventive Measures

* **Verify the Source:** Only scan QR codes from trusted sources. Be cautious of QR codes received via unsolicited emails, text messages, or social media.
* **Inspect the URL:** Before providing any sensitive information, review the URL displayed after scanning the QR code. Ensure it matches the legitimate website of the organization in question.
* **Use a QR Code Scanner with Security Features:** Some QR code scanner apps have built-in security features that can check URLs for authenticity and flag potential threats.
* **Enable Two-Factor Authentication (2FA):** Whenever possible, enable 2FA on your accounts to add an extra layer of security, making it harder for attackers to gain access even if they obtain your credentials.
* **Keep Your Device Secure:** Regularly update your smartphone’s operating system and apps to patch vulnerabilities that attackers might exploit.
* **Educate Yourself:** Stay informed about common phishing tactics, including QR code phishing, to recognize and avoid potential threats.

# Conclusion :😇

Quishing attacks can pose significant risks to individuals and organizations. By being cautious when scanning QR codes, checking website URLs, installing anti-malware software, keeping devices updated, and educating employees, individuals and organizations can protect themselves from these attacks and reduce their chances of falling victim to cybercriminals.