Accessibility links

Facebook   X   LinkedIn   Email

Stop Before You Scan: QR codes Hiding Malware

February 4, 2025

Scanning those helpful QR (quick response) codes get us information in a flash. These handy codes are used everywhere and for everything—and that’s part of the problem. Cybercriminals are creating malicious QR codes that bypass anti-malware. And now, they’re going after those in large and small organizations alike, including financial institutions. Find out why you should stop before you scan that next QR code.

In the QR Crosshairs

Hackers use those busy black and white QR codes to hide malware that infects devices and steals personally identifiable information (PII). Hacking campaigns now use them in phishing emails going after some big organizations. Financial institutions like Chase and CapitalOne, logistics companies like FedEx and DHL, and even Air Canada have all been in the QR code crosshairs. Human Resource departments are a big target because they have access to a lot of sensitive information. After all, it’s so easy to scan it and go right where you think you need to be. So why wouldn’t you scan it?

Well, in one case, an employee was sent a phishing email, including a QR code, from “Payroll and Benefits.” Once scanned, they ended up on a phishing page designed to steal their PII, and then not only HR had their PII, so did the hacker.

As much as QR codes are convenient, there’s risk involved in scanning them. One safety measure is always using 2FA when it’s available since it provides an additional layer of identity security. Another is not being “QR crazy,” so limit scanning to only those that are necessary and trustworthy. And if you think you’ve scanned a malicious QR, go directly to the legitimate website and change your password. If you did it at work, contact your IT department or manager immediately.

Remember, like most technology we love to use, including QR codes, cybercriminals love it too but for very different reasons—so next time, stop before you scan.


Old School Phishing Attacks in Your USPS Mailbox

Scams & Phishing

Old School Phishing Attacks in Your USPS Mailbox

It’s not what you’d expect with the usual phishing attacks, but it seems that’s the point. A new flurry of phishing is sending written letters to prospective victims. The letter in your mailbox appears to be from your financial institution, and that leads to trusting what it says. Using the mail is an old school tactic from scammers and it only takes one victim to bite the hook. This scam likely works because these days we expect to get phished via email, text, or phone. But the regular mail? Nonsense! READ FULL STORY
Examples Of Common Smishing Scams

Scams & Phishing

Video Icon Examples Of Common Smishing Scams

According to Verizon, one of the leading telecommunications companies, smishing (SMS phishing) is an increasingly prevalent form of cyber-attack targeting mobile phone users. Smishing messages are deceptive text messages that aim to trick individuals into divulging sensitive information or performing harmful actions. Verizon has identified several common types of these types of messages that users should be aware of to protect themselves from falling victim to these scams. READ FULL STORY
The Quick and Dirty on QR Codes

Mobile Security

The Quick and Dirty on QR Codes

QR codes, those little square mazes, are everywhere nowadays. From accessing restaurant menus to entering sweepstakes and registering new products, they’ve become a staple in modern convenience. However, like any technology, cybercriminals have found ways to exploit these codes, turning them into digital traps. There are many ways these boxes of squiggles can be misused, including via phishing, in advertisements, and overlaid on real ones. READ FULL STORY
43% of Fraudulent Financial Transactions are Authorized

Your Security

43% of Fraudulent Financial Transactions are Authorized

Financial transactions are increasingly under attack according to financial institutions (FIs). They report 43% of all fraudulent transactions involving customers are in the category called “authorized fraud.” This fraud not only costs FIs financially, but some customers lose trust in their FI and that leads to customer retention problems. Fortunately, there’s new optimism using AI (artificial intelligence) and ML (machine learning) to combat the escalating problem of authorized fraud. READ FULL STORY
Email Identity Crisis! Top Brands For Email Phishing And How To Tell The Difference

Scams & Phishing

Email Identity Crisis! Top Brands For Email Phishing And How To Tell The Difference

Some say impersonation is the greatest form of flattery, but it this case, it’s all about email phishing. Cybercriminals use some companies more than others because they’re well-known globally and have better odds for success. According to APWG’s Phishing Activity Trends Report, the U.S. saw over one million email phishing attacks in the first quarter of this year alone, the highest total on record so far. A look at who these companies are and how to avoid email phishing in their name benefits us all. READ FULL STORY