This week, I learned a word I had never heard before.
Sometimes that’s a pleasant occurrence where I learn a really cool word that just isn’t used often today. Others it’s a new term out of Gen Z / Gen Alpha culture that reminds me I lack aura.
But this time was different. It’s a term for a new type of cyberattack. One that’s becoming so prevalent it earned its own name.
That name is quishing. Pronounced KWISH-ing. It’s derived from QR plus phishing, and you can also just called it QR phishing if you prefer.
Here’s what it is, from Cloudflare’s blog: “Quishing, or QR phishing, is a cybersecurity attack in which attackers use QR codes to redirect victims to malicious websites or prompt them to download harmful content. The goal of this attack is to steal sensitive information, such as passwords, financial data, or personally identifiable information (PII), and use that information for other purposes, such as identity theft, financial fraud, or ransomware.”
Where might this show up? QR codes are prevalent in environments where a digital link might be used several times daily, and the link or the content located at that QR code will rarely change. Out in the open world, quishing is hypothetically as simple as printing another QR code and placing it over a legitimate one.
Ever used a QR code to park in a lot? You’re probably in a hurry to get to an event. You scan the code, pay for your overnight parking time, and get to where you need to go.
Two things happen here that make this an easy opportunity for QR phishing:
Technology is being used in a trusted, familiar environment.
There's often a heightened sense of emotion and urgency when interacting with that technology.
Any phishing attempt relies on malicious, but effective communication and understanding of context to find success. Think about the ever-popular gift card request from the CEO, the legitimate-looking request for a money wire from a business partner, the fraudulent OneDrive file share that looks real.
To someone moving fast, who’s just trying to get through their email, the right attempt at the right time can be a major concern for your business.
Here’s some small things every employee can do to support your business’s security:
Check links and attachments carefully. Not everything in your inbox merits being opened or clicked on just because it landed in your inbox. If you weren’t expecting to get a PDF or a Microsoft Form, check two or three times before opening — or worse, sharing any data through it.
Follow up with the “sender” of the message. CEO asked you to buy $5,000 in gift cards? Give your CEO a text or Teams message to double-check. Worst case, you wait until they can give you a quick thumbs-up to confirm the request. Best case, you flag malicious outreach and keep your company from losing money they may be unable to get back.
Detect and negate threats quickly and proactively. The nature of work is very human. There may certainly be times when accounts get compromised or data is exposed. What does your team do next? Proactive monitoring tools such as EDR and MDR (endpoint/managed detection response) software are how you swiftly detect and respond to these types of concerns. If login information is accessed by a malicious actor, MFA (multi-factor authentication) is your best friend. Having the right tools and systems in place mitigates the risk and impact of a cyberattack dramatically.
What We’re Hiring For This Week
Our Technology Talent Managers are always tuned in to the market, creating opportunities for technology professionals and innovative businesses to connect!
Here’s a few roles we’re recruiting for this week:
Senior Splunk SIEM Engineer: This one is plain fun to say! Lead design and architecture for a client’s SIEM infrastructure, ensuring effectiveness, scalability, and alignment. 15+ month contract opportunity in Buffalo, $65-75/hour.
QA Tester (SAP/UiPath): We continue to recruit on both sides of the border! Create and test SAP billing/customer workflows, build regression suites and UiPath automations. Hands-on experience with SAP ECC or SAP S/4HANA and Azure DevOps are important. 12+ month remote contract opportunity in Canada, $85-110/hour CAD.
RSA Archer Developer: Design, develop and enhance solutions within the RSA Archer SaaS platform. 5+ years of experience in application development and systems analysis is expected for this role. 20+ month remote contract opportunity, $75-85/hour.