Threat reportPhishingTL-2026-3416
QR-Code Phishing (Quishing) Bypassing Corporate Email Security; Kimsuky QR Spearphishing
QR-Code Phishing (Quishing) Bypassing Corporate Email (TL-2026-3416), also tracked as Quishing, is a high-severity phishing campaign, first published 2026-10-13. It is attributed to Kimsuky (North Korea) with high confidence, affects Multiple Email security gateways relying on URL extraction and, maps to 13 MITRE ATT&CK techniques (T1056.001, T1078.004, T1111), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 1Kimsuky
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3416
- Threat ID
- TL-2026-3416
- Also known as
- Quishing, QR-code phishing, Kimsuky QR spearphishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- Kimsuky
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- government administration, think tanks, academia, diplomatic, strategic advisory, enterprise
- Target regions
- North America, south korea, Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in QR-Code Phishing (Quishing) Bypassing Corporate Email
Malware and tooling: DocSwap - S9005, KimaLogger, MySpy, RandomQuery (Powershell), RDPWrap
How QR-Code Phishing (Quishing) Bypassing Corporate Email works
ESET reports malicious QR codes were present in 11% of phishing email in H1 2026, hidden in PDF/JPEG attachments and impersonating brands such as DocuSign and Microsoft so that URL filters miss them and victims move to unmanaged mobile devices. The FBI attributes targeted QR-code spearphishing against think tanks, academia and government entities to North Korea's Kimsuky, ending in session-token theft and replay that bypasses MFA.
Quishing embeds a malicious URL in a QR code, typically inside a PDF or image attachment or the email body. Because the URL is an image rather than text, secure email gateways that extract and detonate links often fail to inspect it, and because the victim must scan the code with a phone, the follow-on interaction moves off the managed endpoint onto a personal or unmanaged mobile device that lacks enterprise web filtering, EDR and logging. ESET's H1 2026 Threat Report (summarized in a WeLiveSecurity article published 2026-08-17) measured malicious QR codes in 11% of phishing emails, with the trend tracked from September 2025 to May 2026. Reported lures impersonate DocuSign and Microsoft software updates. Reported outcomes include malware installation and credential theft, MFA token harvesting, direct download of malicious apps that bypass app-store controls, account takeover, payment fraud with pre-filled payment data, contact and calendar poisoning via utility apps, automatic connection to rogue Wi-Fi access points, and URL obfuscation via QR code shorteners.
The FBI flash notice (ic3.gov/CSA/2026/260108.pdf, released January 2026) attributes a targeted variant to Kimsuky, a North Korean state actor linked to the Reconnaissance General Bureau and tracked as APT43, Black Banshee, Emerald Sleet, Springtail, TA427, Thallium, ARCHIPELAGO and Velvet Chollima (aliases vary by vendor). As of 2025 Kimsuky moved from broad QR distribution to personalised spearphishing of think tanks, academic institutions and US and foreign government entities. Documented May-June 2025 incidents: (1) a spoofed foreign adviser asked a think tank leader for insight on the Korean Peninsula and supplied a QR code to a questionnaire; (2) a spoofed embassy employee asked a senior fellow for input on North Korean human rights and offered a QR code for a 'secure drive'; (3) a spoofed think tank employee sent a QR code redirecting to attacker infrastructure; (4) a strategic advisory firm received an invitation to a non-existent conference with a QR code leading to a fake Google account login page that harvested credentials.
The redirect chains collect device and identity attributes (user-agent, OS, IP address, locale, screen size) so that mobile-optimised credential-harvesting pages can be served selectively. FBI assesses the result is session token theft and replay, which bypasses multi-factor authentication and hijacks cloud identities without generating typical MFA-failure alerts. SecurityAffairs additionally lists post-compromise tooling associated with Kimsuky (MySpy, RDPWrap, KimaLogger, RandomQuery) and phishing sent onward from compromised systems; these are associated with the actor generally and are not confirmed in the FBI notice as part of the QR campaigns. Hacker News reports a separate December 2025 Kimsuky campaign distributing DocSwap Android malware through QR codes impersonating Seoul logistics firms.
No CVE, network indicators or file hashes are published in the cited sources. Detection must therefore rely on behaviour: inbound mail with QR-code images or PDFs, mobile browser sign-ins following such mail, and anomalous reuse of authenticated sessions from new IPs or devices. Severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3416
Credential Access
T1056.001 Input Capture: Keylogging; T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie
Initial Access
T1078.004 Valid Accounts: Cloud Accounts; T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link
Execution
T1204.001 User Execution: Malicious Link
Lateral Movement
lateral-movement
T1550.004 Use Alternate Authentication Material: Web Session Cookie
Reconnaissance
T1592 Gather Victim Host Information; T1598.003 Phishing for Information: Spearphishing Link
Defense Evasion
Affected products and versions in QR-Code Phishing (Quishing) Bypassing Corporate Email
- Multiple — Email security gateways relying on URL extraction and sandboxing
Vulnerable versions: Text-based URL inspection without QR decoding - Multiple — Unmanaged personal mobile devices used to scan QR codes
Vulnerable versions: Devices without MDM or mobile security - Google — Google account sign-in (impersonated by fake login page)
Vulnerable versions: Accounts without phishing-resistant MFA
Remediation for QR-Code Phishing (Quishing) Bypassing Corporate Email
Immediate actions
- Flag or quarantine inbound email containing QR-code images or PDFs and decode QR destinations at the email gateway
- Hunt for sign-ins from mobile user agents shortly after delivery of QR-bearing mail and revoke sessions and refresh tokens for affected accounts
- Alert on session token reuse from a new IP address, device or ASN
Workarounds
- Instruct staff not to scan QR codes from unsolicited email and to verify requests out-of-band with the purported sender
- Restrict corporate resource access from unmanaged personal devices
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/passkeys) for remote access and sensitive systems
- Enforce device-bound or token-protected sessions and conditional access requiring managed devices
- Deploy MDM and mobile security that analyses QR-code destinations on employee devices
- Apply least-privilege access and review accounts regularly
- Run user awareness training specific to QR-code phishing and continuously monitor credential entry and QR-related network activity
Weaknesses (CWE) in QR-Code Phishing (Quishing) Bypassing Corporate Email
Timeline of QR-Code Phishing (Quishing) Bypassing Corporate Email
- May 2025 (day approximate): Kimsuky, spoofing a foreign adviser, emails a think tank leader seeking Korean Peninsula insight with a QR code to a questionnaire.
- May 2025 (day approximate): Kimsuky spoofs an embassy employee, asking a senior fellow for input on North Korean human rights and offering a QR code to a 'secure drive'; a further spoofed think-tank-employee email redirects via QR code to attacker infrastructure.
- June 2025 (day approximate): a strategic advisory firm receives an invitation to a non-existent conference with a QR code leading to a fake Google account login page that harvests credentials.
- September 2025 (day approximate): start of the window ESET used to track the growth in malicious QR codes within phishing email.
- December 2025 (day approximate): Kimsuky reportedly distributes DocSwap Android malware via QR codes impersonating Seoul logistics firms (per The Hacker News).
- FBI publishes flash notice 260108 warning that Kimsuky uses QR-code spearphishing and session token theft to bypass MFA.
- Barracuda publishes analysis of the FBI quishing advisory and mitigation guidance.
- ESET WeLiveSecurity reports malicious QR codes in 11% of phishing email in H1 2026 and cites the Kimsuky activity.
Sources cited for QR-Code Phishing (Quishing) Bypassing Corporate Email
- How QR-code phishing can slip past corporate security measures (ESET WeLiveSecurity)
- FBI Flash: Kimsuky QR code spearphishing (260108)
- FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing (The Hacker News)
- North Korea-linked APT Kimsuky behind quishing attacks, FBI warns (Security Affairs)
- FBI quishing advisory warns of North Korean spear-phishing campaign (Barracuda)
- North Korean Hackers Use Phony QR Codes in Phishing Attacks on US Orgs, FBI Warns (Bitdefender)
Detection coverage for TL-2026-3416
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3416 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.