QR codes a powerful new phishing weapon in hands of Pyongyang cyberspies

The FBI warns that DPRK-linked Kimsuky operators have been embedding malicious URLs in QR codes ("quishing") delivered via spear-phishing emails; when scanned, victims are redirected to fake portals (Microsoft 365, Okta, VPN) where credentials and session tokens are stolen and reused to bypass MFA and persist in networks. Campaigns observed in 2025 targeted think tanks, academic institutions, and government organizations connected to North Korea policy, exploiting the limited visibility and controls over unmanaged mobile devices.