Talking about Malicious QR codes

Michael Lortz
Hybrid Analyst
Published in
1 min readFeb 7, 2022

--

From https://www.youtube.com/watch?v=w0YfEsrSfa0

Beware the QR code scams — Mashable, Matt Binder, 1/16/2022

Very interesting article from Mashable on a phenomenon that I saw coming a mile away. Ever since restaurants got cheap and stopped printing laminated menus, QR use has skyrocketed. At first, I didn’t want to download a QR scanner, but I finally acquiesced when servers looked annoyed when I asked for any type of menu. I know they are just the messenger, not the decision maker. But now I am more at risk.

Making malicious QR codes is easy. This youtube video shows you how.

Then, all malicious actors need is to print their malicious QR code on clear stickers and place them over other public QR codes. Then, whenever someone accesses the QR code, they are routed to wherever the malicious actor wants them to go — to a malicious website containing an automatic malware download, for example.

This is why I don’t trust mass use of QR codes. Too easy to turn malicious.

--

--

Michael Lortz
Hybrid Analyst

Writer. Analyst. Trainer. Author: Curveball at the Crossroads, The Man Makes You Work.