# QR-Code Phishing (Quishing) Bypassing Corporate Email Security; Kimsuky QR Spearphishing

> ESET reports malicious QR codes were present in 11% of phishing email in H1 2026, hidden in PDF/JPEG attachments and impersonating brands such as DocuSign and Microsoft so that URL filters miss them and victims move to unmanaged mobile devices. The FBI attributes targeted QR-code spearphishing against think tanks, academia and government entities to North Korea's Kimsuky, ending in session-token theft and replay that bypasses MFA.

- **Published:** 2026-10-13T14:43:19Z
- **Last reviewed:** 2026-10-13T14:43:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3416
- **ID:** TL-2026-3416
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Kimsuky (North Korea)
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Quishing embeds a malicious URL in a QR code, typically inside a PDF or image attachment or the email body. Because the URL is an image rather than text, secure email gateways that extract and detonate links often fail to inspect it, and because the victim must scan the code with a phone, the follow-on interaction moves off the managed endpoint onto a personal or unmanaged mobile device that lacks enterprise web filtering, EDR and logging. ESET's H1 2026 Threat Report (summarized in a WeLiveSecurity article published 2026-08-17) measured malicious QR codes in 11% of phishing emails, with the trend tracked from September 2025 to May 2026. Reported lures impersonate DocuSign and Microsoft software updates. Reported outcomes include malware installation and credential theft, MFA token harvesting, direct download of malicious apps that bypass app-store controls, account takeover, payment fraud with pre-filled payment data, contact and calendar poisoning via utility apps, automatic connection to rogue Wi-Fi access points, and URL obfuscation via QR code shorteners.

The FBI flash notice (ic3.gov/CSA/2026/260108.pdf, released January 2026) attributes a targeted variant to Kimsuky, a North Korean state actor linked to the Reconnaissance General Bureau and tracked as APT43, Black Banshee, Emerald Sleet, Springtail, TA427, Thallium, ARCHIPELAGO and Velvet Chollima (aliases vary by vendor). As of 2025 Kimsuky moved from broad QR distribution to personalised spearphishing of think tanks, academic institutions and US and foreign government entities. Documented May-June 2025 incidents: (1) a spoofed foreign adviser asked a think tank leader for insight on the Korean Peninsula and supplied a QR code to a questionnaire; (2) a spoofed embassy employee asked a senior fellow for input on North Korean human rights and offered a QR code for a 'secure drive'; (3) a spoofed think tank employee sent a QR code redirecting to attacker infrastructure; (4) a strategic advisory firm received an invitation to a non-existent conference with a QR code leading to a fake Google account login page that harvested credentials.

The redirect chains collect device and identity attributes (user-agent, OS, IP address, locale, screen size) so that mobile-optimised credential-harvesting pages can be served selectively. FBI assesses the result is session token theft and replay, which bypasses multi-factor authentication and hijacks cloud identities without generating typical MFA-failure alerts. SecurityAffairs additionally lists post-compromise tooling associated with Kimsuky (MySpy, RDPWrap, KimaLogger, RandomQuery) and phishing sent onward from compromised systems; these are associated with the actor generally and are not confirmed in the FBI notice as part of the QR campaigns. Hacker News reports a separate December 2025 Kimsuky campaign distributing DocSwap Android malware through QR codes impersonating Seoul logistics firms.

No CVE, network indicators or file hashes are published in the cited sources. Detection must therefore rely on behaviour: inbound mail with QR-code images or PDFs, mobile browser sign-ins following such mail, and anomalous reuse of authenticated sessions from new IPs or devices. Severity is analyst-assigned.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1566.002 Phishing: Spearphishing Link
- T1598.003 Phishing for Information: Spearphishing Link
- T1592 Gather Victim Host Information
- T1204.001 User Execution: Malicious Link
- T1684.001 Impersonation
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1056.001 Input Capture: Keylogging
- T1078.004 Valid Accounts: Cloud Accounts
- T1534 Internal Spearphishing

## Sources

- [How QR-code phishing can slip past corporate security measures (ESET WeLiveSecurity)](https://www.welivesecurity.com/en/business-security/qr-code-phishing-slip-past-corporate-security-measures/)
- [FBI Flash: Kimsuky QR code spearphishing (260108)](https://www.ic3.gov/CSA/2026/260108.pdf)
- [FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing (The Hacker News)](https://thehackernews.com/2026/01/fbi-warns-north-korean-hackers-using.html)
- [North Korea-linked APT Kimsuky behind quishing attacks, FBI warns (Security Affairs)](https://securityaffairs.com/186755/intelligence/north-korea-linked-apt-kimsuky-behind-quishing-attacks-fbi-warns.html)
- [FBI quishing advisory warns of North Korean spear-phishing campaign (Barracuda)](https://blog.barracuda.com/2026/01/20/fbi-quishing-north-korean-spear-phishing-campaign)
- [North Korean Hackers Use Phony QR Codes in Phishing Attacks on US Orgs, FBI Warns (Bitdefender)](https://www.bitdefender.com/en-us/blog/hotforsecurity/north-korean-hackers-phony-qr-codes-phishing-attacks-fbi)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3416