FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes

The FBI warns that the North Korean state-sponsored espionage group Kimsuky has targeted government entities, academic institutions, and think tanks with spear-phishing emails containing malicious QR codes. Referred to as quishing, the campaign uses QR codes with embedded malicious URLs to steer victims to attacker-controlled domains that harvest device information and fuel mobile-focused phishing pages that mimic legitimate Microsoft 365, Okta, or VPN portals, according to the FBI.

Once scanned, session cookies can be stolen and replay attacks mounted to bypass multi-factor authentication and hijack cloud identities, enabling propagation of secondary spear-phishing attacks. The alert notes that the compromise path often originates on unmanaged mobile devices outside normal endpoint detection and network inspection boundaries, making quishing a high-confidence, MFA-resilient identity intrusion vector in enterprise environments.

In May and June 2025, Kimsuky was seen using quishing in four attacks targeting think tanks and a strategic advisory firm, with emails spoofing a foreign advisor, an embassy employee, and a think tank staffer. Active since at least 2012 and also known by several other names, the group was sanctioned by the US in 2023 for activities supporting Pyongyang’s weapons programmes.