ZDNET

What is phishing?

Phishing is a type of social engineering attackers use to deceive people into revealing or handing over sensitive information (such as usernames and passwords) or even installing malicious software.Also: Kernel security now: Linux's unique method for securing codePhishing has been around for a very long time, and it has taken on numerous forms over the years. In this go-round, the attacks use QR codes, aka quishing.

What is quishing?

Since QR codes are nearly everywhere to provide users with easy access to information they need to access, people are prone to scan them without second-guessing their purpose. Seeing this vulnerability, bad actors have chosen to imitate those helpful QR codes, only to lead the person who scans it to a spoofed site, steal their information, or install malware on their device.

What are some quishing attacks to be on the lookout for?

According to the FTC, there have been reports of scammers covering QR codes on parking meters, which are there to enable people to pay for the parking spot, with their own, malicious QR code stickers. The FTC also said another common quishing attack involves sending victims a QR code by text message or email with an urgent reason that they'd have to scan it.

What can you do?

The simplest thing you can do is not scan QR codes…especially those from unknown sources. Specifically, the FTC recommends that if you see a QR code in an unexpected place, you inspect the URL before opening it. When inspecting the link, some things to look out for include making sure you recognize the URL, and even if you do, look for misspellings or a switched letter.