QR Codes Used to Spread Phishing Attacks and Malicious Apps Across Mobile Devices

In Cybersecurity News - Original News Source is cybersecuritynews.com by Blog Writer

QR codes have become a normal way to open links, pay bills, and sign in, but that same speed lets attackers push victims from the physical world into a risky web page or app action in seconds.

In recent campaigns, the QR image is not the threat by itself; it is a delivery wrapper that can hide a long redirect chain.

Besides this it can also trigger in-app deep links, or send the phone to a direct download that bypasses app-store checks, called quishing and it shows up in emails and posters.

QR code threat model (Source – Palo Alto Networks)

Palo Alto Networks researchers noted a rise in malicious QR activity, and over recent months they tracked campaigns mixing phishing and scams, saying their crawlers see about 75,000 QR codes per day, with roughly 15% of those pages leading to malicious links, which adds up to more than 11,000 detections daily.

Malicious QR code shortener example (Source – Palo Alto Networks)

Since most scanning happens on personal mobiles with weaker controls than managed desktops, a single scan can move outside the corporate perimeter, land on a convincing login page, and even disappear quickly when attackers use QR shorteners that can change destinations or go dead after a few days.

In-app deep links and takeovers

Deep links are special URLs that open a specific screen inside an app, and Unit 42 observed over 35,000 QR codes carrying Telegram deep links like tglogin where login links made up 97% of Telegram cases and about one in five host pages looked malicious.

QR code in-app deep link example (Source – Palo Alto Networks)

While other lures tried to link new sessions to Signal, WhatsApp, or Line accounts, and some were highly targeted against Ukrainian Signal users.

Example of a QR code designed to give an attacker full access to the device and account owner’s Telegram (Source – Palo Alto Networks)

Palo Alto Networks also found in-app deep links in around 3% of QR codes, and warned that defenders may miss the follow-on behavior because it can be invisible to normal web analysis, often requiring a mobile sandbox with the target app installed and case-by-case review of custom URL schemes.

Contact poisoning attack scenario (Source – Palo Alto Networks)

To reduce risk, security teams should treat QR codes as untrusted input by scanning them before users do. They should expand monitoring to QR images in web pages and documents, block known QR shortener abuse, and restrict direct APK installs after researchers observed 59,000 detections tied to 1,457 distinct APKs delivered via QR codes.

Organizations should also strengthen email and web filtering to detect QR-based lures and prevent malicious redirects. Continuous user awareness training can further reduce the success rate of QR-driven phishing and malware campaigns.

For users, always verify the source, preview the full URL before opening, and avoid urgent payment prompts. Never approve app logins or device links from random QR codes, keep your OS updated, and disable unknown app installation settings.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.