{"id":59975,"date":"2026-01-09T15:44:52","date_gmt":"2026-01-09T15:44:52","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/qr-codes-a-powerful-new-phishing-weapon-in-hands-of-pyongyang-cyberspies\/"},"modified":"2026-01-09T15:44:52","modified_gmt":"2026-01-09T15:44:52","slug":"qr-codes-a-powerful-new-phishing-weapon-in-hands-of-pyongyang-cyberspies","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/qr-codes-a-powerful-new-phishing-weapon-in-hands-of-pyongyang-cyberspies\/","title":{"rendered":"QR codes a powerful new phishing weapon in hands of Pyongyang cyberspies"},"content":{"rendered":"

North Korean government hackers are turning QR codes into credential-stealing weapons, the FBI has warned, as Pyongyang’s spies find new ways to duck enterprise security and help themselves to cloud logins.<\/p>\n

In an advisory published this week<\/a>, the agency said the Nork-linked “Kimsuky” group has been embedding malicious URLs inside QR codes delivered in carefully-crafted spear phishing emails, a technique the industry is now calling “quishing.” <\/p>\n

When a target scans the booby-trapped code, usually on a phone that security teams have little visibility into, they are redirected to attacker-run pages posing as Microsoft 365, Okta, or VPN portals, where credentials and session tokens are quietly stolen and later reused to bypass multi-factor authentication.<\/p>\n