What happened
In August 2023 Cofense, a company that analyses phishing reported by its customers, described a campaign that began in May. It started small, then grew to a volume far beyond the usual, Cofense's researcher told The Record. More than 1,000 emails were attributed to it. About 29% went to one target, which Cofense described as a major US energy company. The rest went to companies in manufacturing, insurance, technology and financial services.
Cofense did not name the energy company and did not attribute the campaign to any group. The victim is in this archive without a name because the campaign is one of the best documented early cases of QR codes used against a company at scale.
The email
The messages posed as Microsoft security notifications. They told the recipient to update the security settings of their account, such as two-factor authentication. BleepingComputer reported that the lure gave a short deadline of two or three days. The call to action was a QR code, placed in a PNG image in the body or in a PDF attachment.
Scanning the code with a phone opened a chain of redirects. Many ran through Bing, Microsoft's own search engine. Cofense counted Bing redirects in 26% of the QR codes, and the energy company received 81% of those. The chain ended at a fake Microsoft 365 login page.
Why it worked
A QR code is a link that a person cannot read. Many mail filters inspect the links written in a message. A link encoded in a picture or a PDF is harder for them to find. The redirect through a real Microsoft domain added a layer of apparent legitimacy, both for filters and for people.
Scanning moves the next step to a phone. A personal phone usually sits outside the company's security tools. Its small screen also shows less of the address bar, so a fake login page is harder to spot. The pretext completed the trap: a security notice from Microsoft asking you to secure your account sounds like the safe thing to do.
What it cost
Cofense did not publish how many people scanned the codes or entered passwords. A stolen Microsoft 365 password at an energy company can open email, files and internal systems, and the campaign was built to collect many of them.
What would have helped
A genuine account alert never needs a QR code, because the person can go to the service directly. A rule that is easy to teach follows from that: never scan a code in an email to sign in to anything. Sign-in methods that check the website's real address, such as passkeys and hardware security keys, give a fake login page nothing to steal.
What a warning inside the message would have shown. Antilure marks wording that creates time pressure or asks for sign-in details, and flags a sender that imitates a brand. The lures in this campaign used that kind of wording: a Microsoft security notice with a deadline of two or three days.
Sources
- Major Energy Company Targeted in Large QR Code Phishing Campaign, Nathaniel Raymond, Cofense, 16 August 2023.
- Phishing campaign used QR codes to target large energy company, Jonathan Greig, The Record, 16 August 2023.
- Major U.S. energy org targeted in QR code phishing attack, Bill Toulas, BleepingComputer, 16 August 2023.