FBI Warns of North Korean QR Phishing Campaigns

The FBI warned that North Korean APT Kimsuky ran 2025 'quishing' campaigns using QR codes embedded in spear-phishing emails to send victims to mobile-optimized credential-harvesting pages and attacker-controlled redirectors; the technique collects device attributes, enables credential and session-token theft to bypass MFA, and has targeted think tanks, academic institutions, and government entities. The alert lists specific May–June 2025 incidents and recommends layered defenses including user training, QR verification protocols, MDM/endpoint scanning, phishing-resistant MFA, logging/monitoring, and least-privilege practices.