Smashing smishing by quashing quishing

Smashing smishing by quashing quishing

Speakers: Andrew Brandt, Principal Researcher, Netcraft

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=tAAH6qXsl4A

Overview

In his Virus Bulletin talk, "Smashing smishing by quashing quishing," Andrew Brandt, Principal Researcher at Netcraft, sheds light on the escalating threat of quishing – a sophisticated form of phishing that leverages QR codes to deliver malicious links. Brandt meticulously details how threat actors are evolving their tactics, moving beyond simple QR code scams to highly targeted, multi-stage attacks capable of bypassing traditional security measures and capturing multi-factor authentication (MFA) credentials. The presentation not only exposes the technical underpinnings of these pervasive campaigns but also critiques the current vulnerabilities in mobile operating systems and user interfaces that facilitate their success.

Brandt, drawing upon his extensive experience at companies like Sophos and Netcraft, presents real-world examples of quishing attacks, including those targeting his former colleagues and widespread public scams. He highlights the convergence of quishing with smishing (SMS-based phishing), demonstrating how both vectors exploit the mobile device's environment and a user's inherent trust. The core of his talk culminates in a bold proposal for an industry-wide collaborative solution: a reputation layer integrated directly into mobile operating systems, designed to preemptively identify and block malicious QR code links and messaging URLs before they can cause harm.

This talk is particularly significant for its call to action, urging major technology players, mobile carriers, and security vendors to overcome competitive barriers and collaborate on a standardized, user-centric defense mechanism. Brandt argues that without such collective altruism and regulatory oversight, the problem will continue to escalate, exploiting the very convenience that QR codes and mobile devices offer. His insights provide critical intelligence for defenders and a compelling roadmap for a more secure digital future against these increasingly insidious mobile-first threats.

Background

▶ Watch: Defining quishing: QR codes for phishing (1:20)

The digital landscape is constantly evolving, and with it, the methods employed by cybercriminals. At the core of many online scams is phishing, the fraudulent attempt to obtain sensitive information such as usernames, passwords, and credit card details by disguising oneself as a trustworthy entity in an electronic communication. As technology has advanced, so too have these deceptive practices, giving rise to specialized forms like smishing and quishing.

Smishing specifically refers to phishing attacks delivered via SMS text messages. This method capitalizes on the often-casual nature of text communication and the immediate attention mobile notifications command. Threat actors use smishing to send malicious links, often impersonating banks, government agencies, or delivery services, compelling users to click and compromise their devices or credentials. The prevalence of mobile phones as primary internet access devices has made smishing a particularly potent threat, as mobile environments often offer reduced security protections compared to desktop browsers. For instance, Brandt notes that while Google Safe Browsing offers protection, its full efficacy is sometimes reduced on mobile due to limitations in storage or processing capacity required for a live feed of all malicious URLs.

The newer, and rapidly growing, threat is quishing, a portmanteau of "QR code" and "phishing." QR codes, or Quick Response codes, are two-dimensional barcodes designed to store complex digital information, such as URLs, visually. They have become ubiquitous, used legitimately for everything from restaurant menus to contactless payments. However, threat actors have co-opted this convenience, embedding malicious URLs within QR codes. These codes can be distributed through various means: physically, by sticking fraudulent labels over legitimate parking meters or public signs; or digitally, embedded in emails, documents, or even other messages. The danger of quishing lies in its ability to bypass traditional email and web security filters, as the malicious payload (the URL) is not directly readable by automated systems until the QR code is scanned, typically by a mobile phone camera. This allows the malicious link to reach the user's device without triggering immediate alerts, setting the stage for highly effective Adversary-in-the-Middle (AITM) attacks.

The problem is exacerbated by a fundamental user interface (UI) challenge on mobile phones: when scanning a QR code, it is often difficult to preview the destination URL without accidentally activating the link. This "tap-to-open" default behavior bypasses a crucial moment for user discretion, making accidental navigation to a malicious site much more likely. The talk underscores that this confluence of mobile vulnerabilities, UI design flaws, and evolving threat actor sophistication creates a fertile ground for quishing and smishing campaigns to thrive, necessitating a new approach to defense.

Key Findings

▶ Watch: Attackers use brandjacking, reconnaissance, advanced kits (6:00)

Andrew Brandt's presentation unveiled several critical findings regarding the evolution and sophistication of quishing and smishing attacks, highlighting their pervasive nature and the technical prowess of the threat actors behind them.

Firstly, quishing has moved beyond simple, opportunistic scams to highly targeted and persistent campaigns. Brandt detailed how Sophos, his former employer, became a target for over a year, with employees receiving sophisticated quishing emails. These emails often mimicked legitimate internal communications, appearing to be scanned documents from network printers. Crucially, the initial email body contained no malicious code, and attachments were benign PDFs, deliberately designed to bypass email security gateways. The malicious component was solely contained within a QR code embedded in the PDF, which, when scanned, led to a Microsoft phishing page. This tactic demonstrates a clear understanding of security defenses, leveraging a multi-stage approach to deliver the payload.

A significant finding was the identification of specific phishing-as-a-service (PaaS) kits used by these attackers. Brandt pointed to Onyx as the most likely kit, referencing research by Ardo Bukaya, but also mentioned Tycoon 2FA or Rockstar 2FA as alternatives that operate similarly. These kits are capable of sophisticated Adversary-in-the-Middle (AITM) attacks, framing a legitimate Microsoft login page within a weaponized interface. This allows the attackers to not only capture usernames and passwords but also to relay and capture Multi-Factor Authentication (MFA) data in real-time, effectively bypassing a critical security layer. The kits also incorporated Cloudflare captchas and other Cloudflare tools, leveraging legitimate services to cloak their malicious infrastructure.

The attacks further revealed advanced reconnaissance efforts by threat actors. The malicious PDFs, especially in later stages of the Sophos campaign, contained personalized information such as the employee's name, company, phone number, and department. This level of detail indicated that attackers were conducting significant intelligence gathering to make their lures highly convincing and targeted. They also employed brandjacking, incorporating logos of legitimate companies like DocuSign and even anti-phishing vendors like Egress (a division of KnowBe4) into their malicious documents and pages to enhance credibility.

Brandt also observed the dynamic adaptation of these campaigns to current events and local contexts. Examples included DHL shipment scams that referenced recent tariffs and the "diminimous exception," leveraging topical concerns to create urgency. The phishing pages themselves were localized, automatically displaying in the user's language based on their IP address, demonstrating a global reach and a commitment to maximizing conversion rates. The physical deployment of quishing was strikingly demonstrated by the widespread placement of malicious QR code stickers on parking meters in Bath, UK, specifically targeting tourist areas and even near Netcraft's offices, showcasing a blend of digital and physical attack vectors.

These findings collectively illustrate a landscape where quishing and smishing are not merely nuisances but sophisticated, adaptive, and highly effective attack vectors that exploit both technical vulnerabilities and human psychology, demanding a comprehensive and coordinated defensive response.

Technical Deep Dive

▶ Watch: Real-world quishing: DHL scams, parking meters (10:30)

The quishing attacks detailed by Andrew Brandt represent a significant technical evolution in social engineering, combining multiple layers of deception and technical evasion to achieve credential compromise and MFA bypass. The core technical mechanism revolves around the delivery of a malicious URL via a QR code, which then leads to a sophisticated Adversary-in-the-Middle (AITM) setup.

The initial delivery often starts with an email containing a benign PDF attachment. This is a crucial evasion tactic, as traditional email security filters are designed to scan for malicious executables, scripts, or embedded links within the email body. By placing the malicious URL exclusively within a QR code inside a seemingly innocuous PDF, attackers bypass these automated checks. The PDF itself might contain company logos (e.g., Sophos, DocuSign), lending an air of legitimacy.

Upon scanning the QR code with a mobile phone, the user is directed to a malicious URL. Brandt noted that these URLs often contained the victim's email address as part of the path, indicating a personalized and tracked attack. The destination page is typically a Microsoft phishing page that employs a technique known as framing. Here, a legitimate Microsoft login page (e.g., for Office 365 or Microsoft 365) is embedded or "framed" within an attacker-controlled webpage. The outer, malicious frame contains JavaScript or other scripting that intercepts all user input – usernames, passwords, and critically, Multi-Factor Authentication (MFA) codes. This allows the attackers to perform a live AITM attack, relaying the credentials to the legitimate Microsoft service and capturing the MFA token as it's generated and entered by the victim. The effectiveness of this is underscored by the fact that if a user entered fake credentials not registered with Microsoft, the login would fail, demonstrating real-time interaction with the legitimate service.

The threat actors further enhance their evasion and targeting capabilities through several technical tricks:

• Open Redirects with Google: To obscure the true destination of the malicious URL, attackers sometimes employ open redirect vulnerabilities, particularly with services like Google. This makes it difficult for users to discern the final landing page by simply looking at the initial URL, adding another layer of obfuscation.
• QR Code Protocol Graphics: The QR code protocol itself allows for the legitimate insertion of graphics within the code. Attackers exploit this by embedding company logos (e.g., DocuSign) directly into the QR code, making the visual lure even more convincing and seemingly authentic.
• Phishing-as-a-Service (PaaS) Kits: The observed attacks leverage sophisticated PaaS kits like Onyx, Tycoon 2FA, or Rockstar 2FA. These kits are pre-built frameworks that provide the infrastructure for AITM attacks, dynamic content generation (e.g., boilerplate footer text, localized pages), and evasion techniques. They integrate features like Cloudflare captchas, paradoxically using a security service to protect their own malicious infrastructure from automated takedowns or analysis. Cloudflare's role as a CDN and DDoS protection service means it sits between the host and the end-user, making takedowns more complex as Cloudflare is not the ultimate host, though they are responsive to abuse reports.
• Reconnaissance and Personalization: The technical sophistication extends to the initial targeting. Attackers conduct reconnaissance to gather specific details about employees (name, company, phone number, department). This information is then dynamically inserted into the malicious PDFs and phishing pages, creating highly personalized and believable lures that significantly increase the chances of a successful compromise.
• Localization: The PaaS kits enable dynamic localization of phishing pages. Depending on the victim's IP address, the same malicious page can render in Italian, Hungarian, German, or Spanish. This global adaptability broadens the attack surface and increases the efficacy across different geographical regions.

The interplay of these technical elements – benign PDF delivery, QR code obfuscation, AITM framing, MFA capture, open redirects, brandjacking, and personalized localization delivered via PaaS kits – creates a formidable challenge for traditional security defenses, emphasizing the need for a new, integrated approach at the mobile OS level.

Demo / Proof of Concept

▶ Watch: Overcoming cooperation and financial challenges (18:00)

While Andrew Brandt's talk did not feature a live, interactive "demo" in the traditional sense of executing an exploit on stage, it provided compelling real-world "proof of concept" scenarios that vividly illustrated the efficacy and widespread nature of quishing attacks. These examples served as powerful demonstrations of how the discussed technical principles translate into tangible threats.

The most striking "demo" was the incident in Bath, UK, where Netcraft has offices. Just days before his talk, parking meters across the city, particularly in tourist-heavy areas, were found to be covered with stickers containing malicious QR codes. These stickers directed users to a fake parking payment portal, designed to steal financial information. Brandt's colleagues at Netcraft meticulously mapped these compromised meters, even finding one less than 80 meters from their front door. This incident served as a stark, tangible demonstration of a physical quishing attack vector, highlighting how easily public infrastructure can be weaponized. It underscored the real-world impact and the direct threat quishing poses to everyday citizens, not just corporate targets.

Another "proof of concept" demonstrating the technical challenge was Brandt's anecdote about the difficulty of taking a screenshot of a malicious QR code on a phone without accidentally clicking the embedded link. This subtle but critical UI flaw in mobile operating systems illustrates how the very design of QR code scanners inadvertently aids attackers by making it almost impossible for a user to inspect a URL before potentially activating it. This highlighted the "UI problem with phones" that attackers exploit.

Furthermore, Brandt showcased screenshots of the evolving quishing lures targeting Sophos employees and Netcraft customers. These images, depicting the progression from generic "scanned document" emails to highly personalized DHL shipment scams with current event hooks (like tariffs and the diminimus exception), served as visual evidence of the attackers' adaptability and the increasing sophistication of their tactics. The localized phishing pages, shown rendering in multiple languages based on the visitor's IP address, also visually demonstrated the global reach and technical capability of the underlying PaaS kits.

Finally, Brandt highlighted Netcraft's own defensive tool, a QR code scanning app (netcraft.app). This app allows users to scan QR codes and check them against Netcraft's reputation service to determine if they are malicious. While not a direct "demo" of an attack, it functions as a practical countermeasure and implicitly demonstrates the feasibility of a reputation-based defense, mirroring aspects of his proposed solution. This effectively served as a proof of concept for how a reputation layer could function at the user's device level.

These various examples, from physical sticker campaigns to UI challenges and defensive tools, collectively provided a comprehensive "demo" of the quishing threat and the potential for mitigation strategies.

Defensive Implications

▶ Watch: Essential principles for an effective solution (21:00)

The pervasive and evolving nature of quishing and smishing attacks necessitates a radical shift in defensive strategies, moving beyond traditional perimeter security to a more integrated, mobile-centric approach. Andrew Brandt's "modest proposal" outlines a blueprint for a robust defense, though it hinges on unprecedented cooperation across the tech industry.

The core of Brandt's defensive strategy is the implementation of a reputation layer directly within mobile operating systems. This layer would sit between the phone's camera app (when scanning a QR code) or messaging app (when encountering a URL) and the browser or web view that launches the link. Before a URL is opened, it would be checked against a reputation service to determine if it's malicious. This proactive filtering at the point of interaction is crucial for preventing users from ever reaching phishing sites, especially given the "slow to respond" nature of existing mobile protections like Google Safe Browsing and the UI problem of accidental clicks.

However, the success of this proposal depends on overcoming significant challenges:

1. Industry Cooperation: The most formidable hurdle is securing cooperation from major players like Apple (iOS) and Alphabet (Android), mobile phone providers, mobile network service providers, and security companies. Brandt acknowledges that these entities often have competing financial motives, making altruism a scarce commodity. He suggests that mobile phone providers might be the key, given their broad reach and direct customer relationships, potentially incentivizing OS makers.
2. User Choice and Control: A critical principle for this reputation layer is that users must have control over which reputation service(s) they use. This prevents any single company from gaining a monopolistic advantage or driving business to itself. An open standard is essential, allowing various security vendors to offer their services for integration.
3. Feedback Loop and Accountability: To ensure the effectiveness and accuracy of reputation services, a robust feedback loop is required. This allows providers to understand if their classifications (good, bad, false positive, false negative) are accurate and to continuously improve their efficacy. Furthermore, Brandt argues for accountability for reputation service providers, something currently lacking in the industry. If a service is consistently wrong, there should be consequences or mechanisms for correction beyond a simple "oops."
4. Speed of Response: Given that attackers operate on timelines of "minutes and hours," the reputation system must be incredibly fast. Any delay in identifying and blocking malicious URLs renders the defense ineffective.
5. Dynamic Cloaking and Redirects: Attackers frequently use dynamic cloaking and chains of redirects to obfuscate their final malicious destination. The proposed reputation layer must be capable of resolving these redirects in real-time to identify the true threat, a technically challenging but vital capability.
6. No Data Monetization: Crucially, Brandt insists that this system must not be used to generate marketing profiles, target ads, or reveal user data that could endanger them. User privacy and safety must be paramount, removing financial incentives that could undermine trust and adoption.
7. Legislation: Recognizing the difficulty of voluntary cooperation, Brandt posits that legislation might be necessary to mandate an open standard and encourage OS makers not to seek financial advantage, ensuring the system serves the public good rather than corporate interests.

For defenders today, while this grand vision is pursued, immediate actions include educating users about the dangers of scanning unknown QR codes and clicking suspicious links, regardless of the message's apparent legitimacy. Deploying robust endpoint detection and response (EDR) solutions that can detect AITM attacks and credential harvesting, even on mobile devices, is crucial. Furthermore, security teams should leverage threat intelligence on known phishing kits (like Onyx) and proactively monitor for brandjacking attempts. The emphasis on rapid reporting of malicious infrastructure to service providers like Cloudflare, as highlighted by Brandt, remains a vital, albeit time-consuming, defensive action.

Ultimately, the defensive implications of Brandt's talk are clear: the battle against quishing and smishing requires a fundamental redesign of how mobile security is integrated and managed, driven by collective responsibility and an open, user-centric approach.

Key Takeaways

• Quishing is a Growing and Evolving Threat: Quishing, the use of QR codes to deliver phishing links, is rapidly expanding and becoming highly sophisticated, often bypassing traditional security measures. It's a significant problem across North America and Europe, affecting both individuals and organizations.
• Mobile Devices are Primary Targets and Vulnerable: Attackers specifically target mobile phones because they are often less protected than desktop environments. Mobile UI flaws, such as the ease of accidentally clicking a QR code link before inspection, and reduced efficacy of mobile browser protections (like Google Safe Browsing), contribute to successful attacks.
• Sophisticated Attack Kits and Tactics: Threat actors leverage advanced Phishing-as-a-Service (PaaS) kits (e.g., Onyx, Tycoon 2FA) to conduct Adversary-in-the-Middle (AITM) attacks. These kits enable real-time capture of credentials and Multi-Factor Authentication (MFA) data, dynamic localization of phishing pages, and the use of legitimate services like Cloudflare for evasion.
• Targeted Reconnaissance and Evasion: Attacks are increasingly personalized, incorporating victim-specific information (name, department, company) obtained through reconnaissance. They also employ advanced evasion techniques like benign PDF attachments, brandjacking of legitimate companies (DocuSign, Egress), and open redirects to obscure malicious destinations.
• Call for Industry-Wide Collaboration: A fundamental solution requires unprecedented cooperation between mobile OS makers (Apple, Alphabet), mobile phone providers, and security companies. Andrew Brandt proposes an open standard reputation layer integrated directly into mobile OSes to check URLs from QR codes and messaging apps before they launch.
• Principles for a Secure Future: Any solution must prioritize user choice, consent, and control; avoid financial advantage for OS makers; ensure high standards and accountability for reputation service providers; operate with extreme speed; and strictly prohibit the use of user data for marketing or advertising purposes. Legislation may be necessary to enforce these principles.

About the Speaker(s)

Andrew Brandt is a Principal Researcher at Netcraft, a leading company in internet security services. With a rich background in the security industry, Brandt has worked at several prominent security companies, bringing a wealth of experience to his current role. Beyond his corporate work, he is deeply involved in cybersecurity advocacy and education. He volunteers at a retrocomputing museum, lectures at the University of Colorado, and is a former journalist who covered cybercrime as an investigative reporter and editor at PC World. Brandt is also actively engaged in policy work through "Hackers on the Hill," an organization dedicated to briefing lawmakers on technology and policy issues, with aspirations for international expansion. Additionally, he serves on the board of World Cyber Health, an organization focused on assisting cybercrime victims and training the next generation of malware analysts. His diverse expertise spans technical research, investigative journalism, education, and policy advocacy, making him a knowledgeable and passionate voice in the cybersecurity community.