FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing

According to the FBI, North Korean state‑sponsored actors are using malicious QR codes in spear‑phishing campaigns aimed at think tanks, academic institutions, and government entities in the United States and abroad, a tactic it notes as quishing. The advisory identifies Kimsuky, also tracked as APT43, Black Banshee, Emerald Sleet, Springtail, TA427, and Velvet Chollima, as the threat group behind these operations, which have a history of subverting email authentication to support phishing.

The FBI said it observed Kimsuky using embedded QR codes in targeted phishing efforts several times in May and June 2025, including attempts that spoofed a foreign advisor, an embassy employee, and think‑tank staff to prompt actions that would lead victims to malicious pages or follow‑on activity. It warns that quishing can bypass MFA by stealing session tokens and compromising cloud identities, and notes that these campaigns originate on unmanaged mobile devices outside normal endpoint controls. The advisory emphasises the high‑confidence, MFA‑resilient nature of these intrusions and the risk they pose to enterprise environments.