FBI Warns of Kimsuky Actors Leverage Malicious QR Codes to Target U.S. Organizations

North Korean APT Kimsuky is running QR-code-based spearphishing ("quishing") campaigns targeting U.S. think tanks, NGOs, academics, and government-linked entities focused on North Korea. Scanned QR codes route victims through attacker-controlled redirectors that fingerprint the device and deliver mobile-optimized fake login portals (Microsoft 365, Google, Okta, VPNs); harvested credentials and session cookies are used to bypass MFA, achieve account takeover, enable mailbox abuse and persistent cloud access, and propagate additional QR lures from compromised accounts.