Unveiling the Rising Threat of Quishing Attacks: A Deep Dive into Sophos’ Investigation

In the ever-evolving landscape of cybersecurity, professionals are constantly vigilant against emerging threat techniques. Recently, the Sophos X-Ops team delved into phishing attacks that targeted several employees, resulting in the compromise of sensitive information.

The Intriguing World of Quishing Attacks

The attackers employed a tactic known as "quishing," a blend of QR code and phishing. QR codes, typically used for quick URL sharing, pose a unique challenge as they bypass traditional scrutiny methods like inspecting URLs before clicking. Moreover, the use of mobile phone cameras to scan QR codes adds another layer of complexity, making it challenging to verify the authenticity of the URLs displayed fleetingly on-screen.

Decoding the Quishing Attack Methodology

In a sophisticated move, threat actors sent spearphishing emails to Sophos employees, masquerading as legitimate messages originating from office scanners. The emails, though seemingly genuine, contained inconsistencies like mismatched filenames and unusual subject lines, raising red flags for astute observers.

The PDF attachments embedded with QR codes, adorned with a sense of urgency by claiming expiration within 24 hours, directed recipients to a phishing page mimicking a Microsoft365 login dialog box. This page, designed to extract login credentials and MFA responses, employed the Adversary-in-The-Middle (AiTM) technique to deceive victims.

Unraveling the Quishing Menace

The attack, successful in compromising an employee’s credentials and MFA token, underscored the growing prevalence of quishing attacks among organizations. With attackers continually refining their tactics, the sophistication and volume of quishing PDFs targeting specific individuals are on the rise.

The Emergence of Quishing as a Service

The use of phishing-as-a-service platforms like ONNX Store, leveraging Cloudflare’s anti-bot CAPTCHA features and IP address proxies, poses a formidable challenge for threat researchers. Encrypted JavaScript code adds another layer of obfuscation, highlighting the evolving nature of quishing attacks.

Safeguarding Against Quishing Attacks

To counter the escalating threat posed by quishing attacks, IT administrators are advised to implement a multi-faceted defense strategy. From enhancing employee vigilance and reporting to leveraging advanced email filtering solutions, a proactive approach is crucial in mitigating the risks associated with quishing attacks.

Empowering Your Defense Strategy

As the battle against quishing attacks intensifies, a combination of technical safeguards and human vigilance is paramount. By fostering a culture of awareness and rapid response to suspicious activities, organizations can bolster their resilience against phishing attempts and safeguard their sensitive data.

Take Action Now

For comprehensive guidance on fortifying your defenses against quishing attacks, explore the SophosLabs Github repository for indicators of compromise and invaluable resources.

Stay vigilant, stay informed, and stay one step ahead of the evolving threat landscape. Your cybersecurity is paramount—protect it with knowledge and proactive measures.

If you are dealing with a similar QR-code-enabled phishing attack in an enterprise setting, we have some suggestions about how to deal with these types of attacks:

• Subject matter focused on HR, payroll, or benefits: Most of the quishing emails targeting Sophos use employee paperwork as a social engineering ruse. Messages had subject lines that contained phrases like “2024 financial plans,” “benefits open enrollment,” “dividend payout,” “tax notification,” or “contract agreement.” However, none of the messages came from a Sophos email address. Pay particular attention to messages with similar subject matter, and ensure that all legitimate messages pertaining to these subjects come from an email address internal to your organization, rather than relying on third party messaging tools.
• Mobile Intercept X: Intercept X for Mobile (Android/iOS) includes a Secure QR Code Scanner, available through the hamburger menu in the upper left corner of the app. The Secure QR Code Scanner protects users by checking QR code links against a database of known threats and warns you if Sophos’ URL reputation service knows a website is malicious. However, it has the limitation that it does not follow links through a redirection chain.