Beware this new-ish attacker tactic: QR code attacks

This report describes an observed increase in "qishing"—QR-code-based credential-harvesting attacks that lead victims to malicious login pages and often evade endpoint detection because victims scan codes with personal devices. The authors outline triage and analysis steps (decode QR with ZXing, sandbox the landing page, use dummy credentials to identify credential exfiltration domains, search network telemetry), provide examples of malicious domains and screenshots, and note defensive actions such as prioritizing alerts and a YARA rule to detect grayscale PNG QR attachments.