FBI Warns of Kimsuky Actors Leverage Malicious QR Codes to Target U.S. Organizations

The North Korean state-sponsored threat group Kimsuky has initiated new spearphishing campaigns. These operations actively exploit malicious QR codes to compromise U.S. organizations.

The FBI warns that think tanks, NGOs, academic bodies, and government‑linked entities with a North Korea focus are now being lured with “Quishing” emails that hide malicious URLs behind QR images instead of clickable links.

The shift to QR codes helps the threat actors move victims off protected corporate endpoints and onto less monitored mobile devices.

In these campaigns, Kimsuky operators spoof trusted contacts such as foreign advisors, embassy staff, or fellow researchers. Emails invite targets to scan a QR code to join a conference, open a “secure” drive, or answer a policy survey.

Once scanned, the code silently redirects the user through attacker‑controlled infrastructure that fingerprints the device and then loads a fake login portal for services like Microsoft 365, Google, Okta, or VPN gateways.

After reviewing recent submissions, IC3 analysts identified that the QR chains are tuned to evade normal email security and MFA checks while quietly harvesting credentials and browser session tokens.

These operations often end with full account takeover, mailbox abuse, and long‑term access to cloud resources across the victim network.

A closer look at the infection path shows that the QR codes first resolve to redirector domains that log key attributes such as user‑agent, OS type, IP address, language, and screen size.

Server‑side logic then decides whether to serve a mobile‑optimized phishing page or route the victim away if the profile looks like a scanner or sandbox. In code, a simplified decision block on the server may resemble:-

if "Android" in ua or "iPhone" in ua:
    redirect("/m365/login/mobile")
else:
    redirect("/news/article")

Once the victim lands on the fake page and enters their password and one‑time code, Kimsuky scripts grab both the credentials and any session cookies linked to the login flow. A basic JavaScript pattern can be:

const token = document.cookie;
fetch("/collect", {
  method: "POST",
  body: JSON.stringify({ creds, token })
});

By replaying these tokens, the actors bypass MFA and create or modify access rules, forwarders, and app passwords inside the account.

From there, they send fresh QR‑based lures from the compromised mailbox, making each new wave appear even more trustworthy and keeping their foothold active for extended periods.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.