Automating QR Code Phishing Email Investigations 🔍

At Intezer, our commitment to enhancing security operations efficiency and effectiveness remains unwavering. Today, we’re excited to unveil yet another important feature: QR Code Analysis within our Automated Phishing Investigation pipeline. This addition is specifically tailored to address the evolving landscape of phishing threats, where QR codes are increasingly being weaponized by adversaries.

The Challenge of QR Code Attacks in Phishing

The digital age has seen the proliferation of QR codes in various applications, from payment systems to menu access in restaurants. Cybercriminals, always on the lookout for innovative ways to exploit technology, have latched onto this trend, embedding malicious QR codes in phishing emails. Traditional security measures often overlook these QR codes, leading to a potential blind spot in phishing detection. Read more about this in our previous article about the trend of “Quishing”.

Introducing QR Code Analysis

Our new QR Code Analysis feature is designed to bridge this gap. By seamlessly integrating with our Automated Phishing Investigation pipeline, it ensures that every aspect of a suspicious email, including embedded QR codes, undergoes rigorous scrutiny. This would directly help your security team’s efficiency by escalating relevant threats and accelerating the investigation process of user-reported emails.

For each email containing a QR code, Intezer will:

1. Extract the QR Code: Our system will identify and extract any QR codes present in the email, ensuring no stone is left unturned.
2. Decode and Extract URLs: The extracted QR code will be decoded to reveal the underlying URL or data.
3. Deep Dive Analysis: The extracted URL will then be subjected to our robust analysis engine, determining its intent and origin.

This comprehensive approach ensures that even if a phishing email bypasses traditional detection mechanisms, the malicious QR code won’t escape your notice.

Example of Automated Quishing Investigation

To a give you a sense on how this would work, we will use a real example that our finance team at Intezer got:

As soon as our employee forwarded it to our “abuse” inbox, the Intezer auto phishing investigation kicked in, and extracted all evidence from the suspicious email, including URLs, attachments, images, email content & HTML, and more. As you can see in the following example, one of the extracted URLs were originated from a QR Code image that was attached to the email (note the “Extracted from QR Code” tag):

Once this URL was extracted from the QR code as evidence, it went through deep analysis like all other pieces of evidence, and the URL was thoroughly scanned deemed it to be malicious:

Due to the nature of this incident and its importance, the alert was escalated to our internal security team. All that was required then was to follow the recommendations on the same page:

To summarize the example, a real “quishing” attack was automatically triaged by extracting the URL from the QR code, deeply scanning that URL, and then auto-escalating it back to our security team. It’s that simple!

Seamless Integration and Enhanced Security

For our existing customers who have already integrated our Automated Phishing Investigation pipeline, the good news is that this feature will be available out-of-the-box. There’s no additional setup required; our system will automatically begin analyzing QR codes in tandem with other email artifacts.

Moreover, by adding this layer of QR code analysis, we’re not just responding to current threats but also anticipating future evolutions in the phishing landscape. It’s all part of our vision to provide a holistic security solution that remains one step ahead of cyber adversaries.

Stay Ahead with Intezer

The addition of QR Code Analysis to our Automated Phishing Investigation pipeline underscores our dedication to providing the best Tier-1 SOC experience in the market. By continuously evolving and adapting to the threat landscape, we empower our users to maintain a robust defense against even the most sophisticated attacks.

For those keen to explore this new feature, existing customers can dive right in. If you’re new to Intezer and want to see the QR Code Analysis in action, book a demo with us today or sign up for a free account.

Itai Tevet

Once led a government CERT. Now CEO at Intezer, changing the way we investigate and respond to cybersecurity incidents.