260108.pdf (574 KB)

The FBI FLASH warns that North Korean Kimsuky actors used malicious QR codes in 2025 spearphishing against NGOs, think tanks, academia, government entities, and foreign policy experts focused on North Korea. The quishing emails impersonated foreign advisors, embassy staff, think tank employees, and conference organizers, then directed victims to questionnaires, secure-drive lures, registration pages, or fake Google login pages. The technique moves victims from protected corporate endpoints to unmanaged mobile devices, where redirectors can collect device attributes and serve credential-harvesting pages for Microsoft 365, Okta, VPN, or Google accounts. The intrusion path can end in session token theft, MFA bypass, cloud identity hijacking, persistence, and follow-on spearphishing from compromised mailboxes. The advisory matters because QR-based phishing can evade email URL inspection, rewriting, sandboxing, and endpoint controls that defenders normally rely on.