Malicious QR Code
Attackers embed QR codes in phishing emails, directing victims to fraudulent websites where credentials, payment details, or sensitive information are harvested. QR codes may also be used to distribute malware, tricking users into scanning codes that lead to malicious downloads.
Mapped to
MITRE ATT&CK®
Sub-techniques
TE0018.1
Constructed QR Code
QR codes built using HTML elements (e.g., tables, divs) rather than images, allowing them to appear as legitimate codes while avoiding traditional image-based detection methods.
TE0018.2
Image QR Code
A QR code embedded as an image file (.png, .jpg) in the email body or as an attachment directs victims to a phishing website or triggers unauthorized actions upon scanning.