Invitations tailored to the targets
The FBI has published a warning about targeted phishing campaigns it attributes to Kimsuky, a North Korean state-sponsored group. Organisations and experts connected to North Korean affairs are among those concerned. The 8 January bulletin describes operations observed in 2025: its publication date does not mark the start of the technique.
Documented pretexts include a request for views leading to a questionnaire, while a fake conference leads to a sign-in form impersonating Google. The message uses a credible professional subject to provide a reason to scan.
Why move the interaction to a phone?
The QR code carries an address inside an image rather than a directly readable link. Scanning it from an email displayed on a computer can open the destination on a phone. The journey may then leave the work environment where the email was received and checked.
This is central to “quishing”, or QR phishing. Available protection depends on the phone, browser and organisation’s tools. The bulletin calls for these uses to be included in workplace security; it does not demonstrate that every QR code passes every filter.
The sign-in portal is the sensitive step
An expected invitation and a password request are two separate things to check. Before signing in, you should be able to explain why the service is needed and find its official access route. A familiar appearance or a colleague’s name is not enough to validate the request.
The FBI also discusses session token theft, which can allow an authenticated session to be reused. Multi-factor authentication remains useful; phishing resistance and session management also matter. For an organisation, choosing protections and responding to an incident belongs with its security team.
Confirm the invitation before following its QR code
A call or exchange through an already known channel can confirm the invitation without relying on the received message. For an event, look for its programme on the organiser’s official website. If you have already supplied work credentials or approved an unusual request, promptly tell your support team what you did.
Our security guide brings together the points to examine. For an image you already have, the Qurl reader displays decoded content without automatically opening the link. Reading an address does not authenticate an invitation: the guide to unexpected destinations helps explain the following steps.