In January 2026, the FBI issued an [advisory](https://www.ic3.gov/CSA/2026/260108.pdf) naming Kimsuky, the North Korean state, linked hacking group also tracked as APT43, as the actor behind a wave of spear, phishing emails carrying malicious QR codes. The targets were not random consumers. They were think tanks, universities, government entities, strategic advisory firms, and embassy, connected organisations, with phishing themes built around geopolitical analysis requests and fake conference invitations. Victims who scanned the code on a phone were routed to a fraudulent page built to harvest login credentials, and from there, according to the advisory, attackers were able to steal and reuse active session tokens, walking past multi, factor authentication entirely.

This is worth sitting with for a moment. A state, sponsored intelligence operation chose a QR code as its entry point, not because it is clever in a novelty sense, but because it reliably defeats the layer of defence most organisations are proudest of.

Most enterprise email security stacks are built to inspect text, links, and attachments. A QR code is an image. It slides past the filter, lands in an inbox looking completely clean, and only becomes a threat once a phone camera decodes it, at which point the victim has usually left the network the security team actually monitors. The FBI's own language on this is direct: it now considers quishing "a high, confidence, MFA, resilient identity intrusion vector in enterprise environments", precisely because the attack finishes on an unmanaged personal device, outside the visibility most security operations centres have.

Separately, researchers at [Barracuda](https://blog.barracuda.com/2025/08/20/threat, spotlight, split, nested, qr, codes, quishing, attacks) documented a related evolution in 2025: QR codes split across two separate images, or nested inside another code, designed specifically to defeat the automated scanning tools that had started to catch ordinary QR phishing. In other words, as detection caught up, the attackers adapted the format, not the underlying trick.

The same basic trust in QR codes shows up closer to home too, and at a much smaller scale. Abu Dhabi Police and Dubai's RTA and Parkin app both issued public warnings after fraudulent QR stickers were found placed over real ones on parking payment signs, redirecting drivers to fake payment pages. It is a different threat model entirely from a nation, state credential harvesting operation, but the underlying weakness is identical: nobody has been trained to be suspicious of a QR code the way they have been trained to be suspicious of a link.

Do we have visibility into what happens after an employee's phone decodes a QR code, or does our monitoring stop at the inbox?

If a session token were stolen today, would our systems detect the reuse of that token from an unfamiliar device or location?

Has our phishing simulation programme tested QR, based scenarios, or only email links and attachments?

Do our executive and high, access accounts have any additional protection beyond standard MFA that would survive a token replay attack?

Delivered as a QR code in an email, on a printed page or on a poster. It gets past defences because it is an image, so text and link scanning never see it. The device targeted is usually a mobile phone camera, often an unmanaged one. Demonstrated by the FBI advisory on Kimsuky in January 2026.

Delivered as an email link or attachment, and it can reach any device with email access. It is increasingly caught by modern email security. Seen in standard enterprise phishing campaigns.

Delivered as a link in a text message, straight to a mobile phone, where it is rarely filtered. Typical examples are bank and delivery impersonation texts. Read more in [What Is Smishing?](/resources/blog/what, is, smishing)

Quishing has moved from a curiosity, parking meters and restaurant menus, to a documented method used by a state intelligence service against government and policy targets. That shift changes the calculus for any organisation that assumes multi, factor authentication is a solved problem. It is not a reason to panic, but it is a reason to test the assumption directly rather than take it on faith.

This is exactly the kind of MFA, resilient, identity, level attack SimuPhish's simulations are built to test for, running realistic QR, based scenarios across the same channels these advisories are now describing, rather than the ones covered in last year's training module.