FBI: North Korean 'Quishing' Campaign Exploits QR Codes to Breach US Organizations (2025)
In May and June 2025, North Korean state-backed group Kimsuky (also known as APT43) launched a wave of spear-phishing attacks leveraging malicious QR codes—known as "quishing"—against U.S. and foreign think tanks, academic institutions, and government entities. Attackers embedded QR codes in spoofed emails designed to bypass enterprise security controls by luring recipients into scanning codes with unmanaged mobile devices. These malicious codes redirected victims to attacker-controlled infrastructure for credential harvesting, cloud account takeover, and the deployment of Android malware such as DocSwap. The campaign enabled threat actors to steal session tokens, circumvent multi-factor authentication, and maintain persistence in organizational environments via compromised identities and secondary phishing from breached mailboxes. This incident underscores a significant shift toward MFA-resilient, mobile-driven spear-phishing tactics that exploit overlooked security gaps at the intersection of email and mobile authentication. The campaign represents a new wave of targeted attacks exploiting trust in QR codes and mobile workflows as adversaries adapt to improved enterprise email defenses.
Kill Chain
