FBI Flags Quishing Attacks From North Korean APT

A state-sponsored North Korean threat group linked to Kimsuky has adopted a QR code-based quishing technique in spear-phishing campaigns aimed at US and foreign government agencies, NGOs and academic institutions, according to an FBI flash alert. The alert notes that quishing campaigns use malicious QR images either as email attachments or embedded graphics to bypass many email defences, directing victims to credential harvesting pages when scanned on mobile devices.

It cites several incidents from May and June 2025, including one where attackers impersonated a foreign adviser in emails to a think tank head containing a malicious QR code, and another against a strategic advisory firm inviting employees to a fake conference with a QR code for a non-existent registration page. The FBI also warned quishing can defeat MFA protections by stealing session tokens and enabling replay, allowing attackers to hijack cloud identities without triggering MFA failure alerts.

Barracuda’s findings from last summer about a phishing-as-a-service kit named Gabagool, which splits QR codes into two images to mislead security scanners, are cited as a broader context for the technique.