Research | Our Q3 report details what's new in the world of ransomware.
Reduce Alert Noise and False Positives
Boost your team's productivity by cutting down alert noise and false positives.
Automate Security Operations
Boost efficiency, reduce burnout, and better manage risk through automation.
Dark Web Monitoring
Online protection tuned to the need of your business.
Maximize Existing Security Investments
Improve efficiencies from existing investments in security tools.
Move your security operations beyond the limitations of MDR.
Secure with Microsoft 365 E5
Boost the power of Microsoft 365 E5 security.
Secure Multi-Cloud Environments
Improve cloud security and overcome complexity across multi-cloud environments.
Secure Mergers and Acquisitions
Control cyber risk for business acquisitions and dispersed business units.
Solve security operations challenges affecting critical operational technology (OT) infrastructure.
Force-Multiply Your Security Operations
Whether you’re just starting your security journey, need to up your game, or you’re not happy with an existing service, we can help you to achieve your security goals.
Detection Investigation Response
Modernize Detection, Investigation, Response with a Security Operations Platform.
Locate and eliminate lurking threats with ReliaQuest GreyMatter
Find cyber threats that have evaded your defenses.
Security metrics to manage and improve security operations.
Breach and Attack Simulation
GreyMatter Verify is ReliaQuest’s automated breach and attack simulation capability.
Digital Risk Protection
Continuous monitoring of open, deep, and dark web sources to identify threats.
GreyMatter Phishing Analyzer removes the abuse mailbox management by automating the DIR process for you.
The GreyMatter cloud-native Open XDR platform integrates with a fast-growing number of market-leading technologies.
Unify and Optimize Your Security Operations
ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints.
Brands of the world trust ReliaQuest to achieve their security goals.
Learn how to achieve your security outcomes faster with ReliaQuest GreyMatter.
The latest security trends and perspectives to help inform your security operations.
Industry Guides and Reports
The latest security research and industry reports.
Catch up on the latest cybersecurity podcasts, and mindset moments from our very own mental performance coaches.
A deep dive on how ReliaQuest GreyMatter addresses security challenges.
The latest threat research report from ReliaQuest Threat Research research team.
The latest white papers focused on security operations strategy, technology & insight.
Current and future SOC trends presented by our security experts.
Events & Webinars
Explore all upcoming company events, in-person and on-demand webinars
From prevention techniques to emerging security trends, our comprehensive library can arm you with the tools you need to improve your security posture.
Get the latest threat analysis from the ReliaQuest Threat Research Team. ReliaQuest ShadowTalk Weekly podcast featuring discussions on the latest cybersecurity news and threat research.
ReliaQuest's ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk's hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week's top cybersecurity stories.
November 30, 2023
We bring our best attitude, energy and effort to everything we do, every day, to make security possible.
Security is a team sport.
No Show Dogs Podcast
Mental Performance Coaches Derin McMains and Dr. Nicole Detling interview world-class performers across multiple industries.
Make It Possible
Make It Possible reflects our focus on bringing cybersecurity awareness to our communities and enabling the next generation of cybersecurity professionals.
Join our world-class team.
Press and Media Coverage
ReliaQuest newsroom covering the latest press release and media coverage.
Become a Channel Partner
When you partner with ReliaQuest, you help deliver world-class cybersecurity solutions.
How can we help you?
A Mindset Like No Other in the Industry
Many companies tout their cultures; at ReliaQuest, we share a mindset. We focus on four values every day to make security possible: being accountable, helpful, adaptable, and focused. These values drive development of our platform, relationships with our customers and partners, and further the ReliaQuest promise of security confidence across our customers and our own teams.
QR codes—those little arrays of black and white squares we scan with our smartphones—quickly turned from convenient to risky. As businesses increasingly adopt their use, especially since COVID-19 accelerated contactless tendencies, QR code phishing (aka quishing) has staked its claim in the cyber-threat landscape.
In September 2023, ReliaQuest saw a 51% increase in quishing attacks, as compared to the cumulative figure for January through August 2023. This spike is at least partially attributable to the increasing prevalence of smartphones having built-in QR code scanners or free scanning apps; users are often scanning codes without even a thought about their legitimacy.
The impacts of quishing can be severe: financial loss if banking login credentials are exfiltrated, malware deployment that leads to operational disruption, and/or data loss. Let’s go over four techniques that threat actors are using to increase their quishing success, and how to mitigate them.
Quishing methods often overlap with standard phishing protocol (learn about the latter, and how to automate your phishing playbook, here). Targets receive an email from a purportedly legitimate sender, who encourages them to scan the embedded QR-code image. The attacker usually tries to create a sense of urgency, such as foreshadowing dire consequences if the recipient doesn’t comply.
In August 2023, ReliaQuest investigated an email received by an employee of an educational institution. The sender had spoofed the institution’s domain, and the email contained a QR-code image leading to a URL that resolved to a location in Russia.
The domain hosted a page masquerading as the customer’s web application. Had the employee actually fallen for the attack and navigated to that page, they would have been prompted to provide the login credentials for all their professional accounts or face purported account deletion. No compromise was achieved, in this case. On to the next technique.
Quishing emails typically mimic the branding and personas of legitimate technology or banking organizations. In some instances, mimicking isn’t even necessary: The attacker has already compromised an email account belonging to an organization and can then send a message from the entity’s legitimate domain.
Those unfortunate recipients who scan the QR code typically find themselves on a landing page that asks for their banking or security credentials.
In the past 12 months, around 56% of quishing emails detected in ReliaQuest customer incidents involved Microsoft two-factor authentication (2FA) resets or enablement. Recipients were encouraged to enter their Microsoft email address and password. Online banking pages were also a popular method, used in 18% of the emails from that period.
Quishing: Word on the Street
On cybercriminal forums, quishing chatter is getting louder. On several occasions, ReliaQuest has witnessed forum members sharing links to QR-code generators or articles about quishing techniques. One member even shared a complete guide to QR code phishing (practically a written invitation for novice quishers). Another member suggested using an adversary-in-the-middle phishing technique: sending QR codes via Telegram, to lead unwitting users to a malicious domain intended to target cryptocurrency exchange platforms where all interactions will be monitored by the threat actor.
Attackers can hide a QR code in a PDF or JPEG file attached to the quishing email, rather than in the email body. With a benign—or even blank—message body, there’s less chance that email filters will flag the message. (Those filters don’t extract embedded URLs from image files, yet.) Smuggling in attachments appeared in 12% of the quishing incidents we sampled in the past 12 months.
In July 2023, a quishing email was sent to a healthcare company’s employee from a compromised account associated with a legitimate third party. The email body was empty, but the text in the PNG file directed the user to scan the QR code it contained, using their mobile device. This was likely an effort to steer them away from the safety of their corporate network, where any associated proxy traffic would be logged.
A scan would lead to a malicious landing page that looked like the customer’s login page. By decoding it, we identified an open-redirect phishing technique using base64 to pass parameters, such as the recipient’s email address, name, and organization. That technique not only changes a landing page based on the arguments, but also makes it appear as though user credentials are cached. (We talk more about open redirect attacks here.)
This quishing incident is typical of large-scale, credential-harvesting campaigns, and the employee was probably one of many targets.
QR-code scanning apps often display the encoded link before asking the user whether they want to navigate to it. Quishing attackers work around this, such as by redirecting the scanner to trusted domains of legitimate services, and/or to typo-squatted URLs. We saw that kind of activity in 18% of quishing attacks sampled in the past 12 months.
An August 2023 spearphishing campaign used a malicious QR code in an email to the CEO of a US-based healthcare organization. The email header read: “[POTENTIAL PHISH] [External] 5 Undelivered Emails from [client name redacted].” The sender used the domain of a legitimate Spain-based steel company.
The email body featured a fake Microsoft 365 logo, and the recipient was encouraged to scan a QR code to receive allegedly undelivered emails. The domain that QR code directed to would quickly steer the scanner through two different domains, to eventually land on a third, malicious, page.
QR code phishing is still relatively new, but it’s likely to gain ground as more threat actors learn how difficult it is for enterprises to defend against the threat. Future quishing attacks will probably be even more widespread and sophisticated.
It’s difficult to detect QR code attacks via email filtering methods: The malicious activity often takes place on a mobile device, and email-filtering tools can’t scan QR codes yet. Detection of QR codes depends largely on the email app a victim uses and the alerts it generates.
However, ReliaQuest’s GreyMatter Phishing Analyzer (GMPA) can extract and analyze encoded URLs found in QR codes, focusing on the most common image MIME types: JPEG and PNG. GMPA extracts the embedded and attached images from the reported email, then transforms them through a barcode reader. If QR code text is present, the system extracts the text and looks for URLs. Identified URLs are then fed through our analyzers for deeper analysis.
There are also several other steps you can take to minimize the threat of quishing:
Get a live demo of our security operations platform, GreyMatter, and learn how you can improve visibility, reduce complexity, and manage risk in your organization.