This is a new term to me.
Quishing:
a business email compromise (BEC) attack that uses QR codes in embedded PDF documents to redirect victims to phishing URLs.
There is a Phishing-as-a-Service (PhaaS) platform called ONNX Store, which apparently has a user-friendly interface to enable the orchestration of phishing attacks. Good to know there are services making it easy to launch cyber attacks.
This new approach uses QR codes embedded in PDF documents to direct victims to the bad URL. I think we are all getting better at spotting bad links and avoiding them. QR codes input the URL without you getting a good look at it. At interesting vulnerability. Plus you are likely using a mobile device to scan the QR code and redirect to the website. Most mobile devices are personal don’t have the robust enterprise protections of the office device.
This new Quishing Attack takes you to a face Microsoft 365 login page and has some hacks to get around two-factor authentication.
The Quishing attacks were first targeted at financial institutions. This must have included broker-dealers because FINRA published an alert.
Sources: