Quick Summary
The FBI has issued a warning about the North Korean hacker group Kimsuky using malicious QR codes in spearphishing campaigns targeting U.S. organizations. This technique, known as ‘quishing,’ has been employed against entities involved in North Korea-related policy, including think tanks and government agencies. Kimsuky has previously exploited vulnerabilities and impersonated journalists, making these attacks particularly concerning for cybersecurity and privacy.
The Securityish Brief
The FBI has alerted that the North Korean state-sponsored hacker group Kimsuky is employing malicious QR codes in spearphishing campaigns aimed at U.S. organizations. These attacks have primarily targeted entities involved in North Korea-related policy, research, and analysis, such as non-governmental organizations, think tanks, academic institutions, and government bodies.
In these campaigns, Kimsuky actors have sent emails containing QR codes that redirect victims to malicious sites disguised as questionnaires or secure drives. For instance, in June 2025, they sent a spearphishing email to a strategic advisory firm inviting recipients to a non-existent conference. This demonstrates the group’s ability to craft convincing scenarios to lure victims.
The quishing technique allows attackers to bypass traditional email security measures by forcing targets to use their mobile devices to scan QR codes. This method collects device information and directs users to phishing pages that impersonate legitimate services like Microsoft 365 or Google login pages. The ultimate goal is to steal access credentials or tokens.
The FBI describes these operations as an ‘MFA-resilient identity intrusion vector’ since they originate from unmanaged mobile devices, making them difficult to detect with standard security protocols.
To combat these threats, the FBI recommends organizations implement targeted employee training, verify the sources of QR codes, enforce multi-factor authentication, and utilize mobile device management solutions. Reporting such incidents to local FBI Cyber Squads or the IC3 portal is also advised.
Understanding Quishing Risks
The rise of quishing highlights a significant shift in phishing tactics, where attackers leverage QR codes to exploit users’ trust in mobile technology. This trend poses a heightened risk for organizations, especially those involved in sensitive policy areas.
Organizations must remain vigilant and educate employees about the potential dangers of scanning QR codes from unknown sources. Regularly updating security protocols and monitoring for suspicious activities can help mitigate these risks.
Key Takeaways
- Educate employees about the risks associated with scanning QR codes from unknown sources.
- Implement mobile device management solutions to monitor and secure devices accessing company data.
- Verify the source of any QR codes before scanning to avoid malicious redirects.
- Enforce multi-factor authentication to add an extra layer of security against unauthorized access.
- Report any suspicious emails or QR code incidents to your local FBI Cyber Squad or the IC3 portal.
Key Terms & Concepts
- Kimsuky: In this article, Kimsuky refers to a North Korean state-sponsored hacker group known for spearphishing and other cyber attacks.
- Quishing: Quishing is a phishing technique that uses malicious QR codes to trick victims into revealing sensitive information.
- MFA: MFA stands for multi-factor authentication, a security measure that requires multiple forms of verification to access accounts.
Read the original article here: https://www.bleepingcomputer.com/news/security/fbi-warns-about-kimsuky-hackers-using-qr-codes-to-phish-us-orgs/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
