QR Code Attack Techniques

Homoglyph Attacks: The Art of Visual Deception

Homoglyphs are characters from different writing systems that appear identical or nearly identical to the human eye but are treated as different by computers. Attackers exploit this to create domain names that look legitimate but lead to malicious sites.

How It Works

• Cyrillic Substitution: Using Cyrillic 'а' (U+0430) instead of Latin 'a' (U+0061) to create domains like "pаypal.com" (note the Cyrillic 'а').
• Greek Letters: Replacing 'o' with Greek omicron (ο) or 'p' with Greek rho (ρ) to mimic legitimate domains.
• Unicode Variants: Exploiting the vast Unicode character set to find visually similar characters from various alphabets and symbols.
• Punycode Encoding: Browsers convert internationalized domain names (IDN) to ASCII using punycode, often hiding the deception from users.

Real-World Examples

• apple.com vs аpple.com: The second uses a Cyrillic 'а' and would display as "xn--pple-43d.com" in punycode.
• google.com vs gооgle.com: Using Cyrillic 'о' characters makes detection nearly impossible without careful inspection.
• Mixed Scripts: Combining Latin, Cyrillic, and Greek characters in a single domain to bypass simple detection filters.

Why QR Codes Amplify This Threat

QR codes hide the full URL until after scanning, giving users no opportunity to inspect for homoglyphs visually. Most phone cameras don't highlight suspicious Unicode characters, and preview notifications show the deceptive domain in its rendered form, not its punycode representation.

Phishing & Credential Harvesting

Attackers create convincing fake login pages that mimic legitimate services to steal usernames, passwords, and other sensitive information.

Common Tactics

• Branded Templates: Pixel-perfect copies of login pages from banks, email providers, and social media platforms.
• SSL Certificates: Free certificates from Let's Encrypt make fake sites display the padlock icon, creating false trust.
• Typosquatting: Registering domains with common typos (gmai1.com, faceboook.com) to catch inattentive users.
• Subdomain Tricks: Using legitimate brand names in subdomains (paypal.secure-login-verify.com) to appear trustworthy.
• Open Redirects: Exploiting legitimate sites with redirect vulnerabilities to launder the initial URL through a trusted domain.

Advanced Social Engineering

• Urgency & Fear: Messages claiming "Your account will be suspended" or "Unauthorized login detected" to pressure immediate action.
• Authority Impersonation: Posing as IT support, security teams, or executives requesting credential verification.
• Context-Aware Attacks: Targeting users during tax season with fake IRS portals (USA), skatteverket (SWE) or during holidays with fake shipping notifications.
• Multi-Factor Bypass: Real-time phishing kits that intercept and replay 2FA codes to the legitimate service within seconds.

Malware Delivery & Drive-By Downloads

QR codes can direct users to sites that automatically download malicious software or trick them into installing malware disguised as legitimate apps.

Delivery Methods

• Fake App Stores: QR codes pointing to third-party app stores hosting trojanized versions of popular apps.
• APK/IPA Files: Direct downloads of Android or iOS app packages bypassing official store security checks.
• Browser Exploits: Targeting unpatched vulnerabilities in mobile browsers to achieve remote code execution.
• Social Engineering Downloads: Fake software updates, PDF viewers, or video codecs that are actually malware.
• Malvertising: Malicious ads served through legitimate ad networks, triggered when scanning QR codes on compromised sites.

Payload Types

• Banking Trojans: Mobile malware that overlays fake login screens on banking apps to steal credentials.
• Spyware: Apps that harvest contacts, messages, location data, and call logs without user knowledge.
• Ransomware: Mobile ransomware that encrypts device storage and demands cryptocurrency payment.
• Cryptominers: Background processes that use device CPU/GPU to mine cryptocurrency, draining battery and degrading performance. (Mostly targeting Android devices)
• Botnet Clients: Turning mobile devices into bot nodes for DDoS attacks or spam distribution.

URL Shortener Exploits

URL shorteners mask the true destination, making them perfect for hiding malicious links. Attackers exploit both the shortening services and user trust in familiar domains.

Attack Vectors

• Link Hijacking: Compromising shortener accounts to redirect existing, trusted links to malicious sites.
• Preview Poisoning: Manipulating Open Graph metadata to display fake previews that don't match the actual destination.
• Time-Based Attacks: Links that initially redirect to legitimate content but switch to malicious sites after gaining trust or passing security scans.
• Geographic Targeting: Redirecting users differently based on IP address—legitimate content for security researchers, malware for targets.
• Custom Shorteners: Creating fake URL shortener services that look legitimate but always redirect to attacker-controlled infrastructure.

Poisoned Waterhole Attacks

Attackers compromise legitimate websites frequently visited by target audiences and inject malicious QR codes or links, turning trusted sources into delivery mechanisms.

Attack Stages

• Initial Compromise: Exploiting vulnerabilities in website CMS, plugins, or supply chain dependencies to gain access.
• Code Injection: Adding malicious scripts or replacing legitimate QR codes with poisoned versions without detection.
• Targeted Delivery: Serving malicious content only to specific user agents, geographic locations, or during certain time windows.
• Evasion Techniques: Using obfuscation, polymorphic code, and anti-analysis tricks to avoid detection by security tools.

Real-World Scenarios

• Restaurant Menus: Replacing QR codes on compromised restaurant websites with codes leading to payment skimmers.
• Parking Systems: Injecting malicious QR codes into parking payment portals to harvest credit card information.
• Corporate Intranets: Targeting internal company portals to deliver malware specifically to employee devices.
• Event Registration: Compromising event websites to replace legitimate registration QR codes with phishing links.

Prevention Strategies

Protecting yourself requires a combination of technical controls, behavioral awareness, and organizational policies.

Personal Best Practices

• Preview Before Proceeding: Always check the full URL shown by your device before opening it in a browser.
• Verify Domain Legitimacy: Manually type known URLs for sensitive operations like banking or shopping instead of scanning codes.
• Use Security Tools: Install mobile security apps that scan URLs and warn about known malicious sites.
• Check for HTTPS: Ensure the site uses HTTPS, but remember that HTTPS alone doesn't guarantee legitimacy.
• Be Skeptical: If a QR code appears in an unexpected location (sticker over existing code, random public place), don't scan it.

Organizational Controls

• QR Code Policy: Establish clear guidelines for where official QR codes will appear and how employees should verify them.
• Security Awareness Training: Regularly educate employees about QR code threats and social engineering tactics.
• Mobile Device Management: Implement MDM solutions that restrict app installations and monitor for malicious activity.
• Network Security: Deploy DNS filtering, web proxies, and threat intelligence feeds to block access to known malicious sites.
• Incident Response Plan: Have procedures for reporting suspicious QR codes and responding to potential compromises.

Detection & Response

Identifying QR code attacks early can prevent significant damage. Here's what to look for and how to respond.

Warning Signs

• Suspicious Placement: QR codes on stickers, overlays, or in unusual public locations.
• Generic Branding: Professional-looking codes without specific company logos or context.
• Urgency Messaging: Text demanding immediate action or threatening consequences.
• Unexpected Redirects: Being taken to a different domain than expected based on context.
• Login Prompts: Being asked to log in when you shouldn't need to authenticate.
• Download Requests: Any prompt to install apps or download files from a QR code scan.

If You've Been Compromised

• Immediate Action: Disconnect from network, change passwords from a different device, enable 2FA if not already active.
• Scan for Malware: Run a full security scan with updated antivirus software.
• Monitor Accounts: Watch for unauthorized transactions, login attempts, or data breaches.
• Report the Incident: Notify relevant parties (IT security, financial institutions, affected services).
• Document Everything: Take screenshots, note URLs, and preserve evidence for investigation.