PDF documents are being hijacked with malicious QR codes

Cybersecurity experts have revealed a specific phishing tactic which has become increasingly popular – including malicious QR codes in .PDF files.

Researchers from Barracuda said that in the three months between June and September 2024, they observed (and later analyzed) more than half a million of phishing emails employing this tactic.

By sharing QR codes in .PDF files, threat actors are doing a number of things: first – they are evading detection from email security solutions, who can now scan the contents of images in the email’s body, but not in the .PDF files attached; and second – they are tricking users into accessing malicious content via their mobile devices, which are generally less defended compared to their desktop counterparts.

Shift in tactics

The overall theme of these attacks remains the same – the hackers would impersonate a major brand, and send out an email that warranted a swift reaction. That email could be a pending invoice, a payment notification, information about a bounced parcel, or something similar. The victims were urged to respond immediately, with further information being provided in the .PDF file attached.

Since .PDF files are not as dangerous as .EXE or .LNK files, they rarely raise any suspicion with the victims. Opening the file up does nothing, but it also shows nothing except the QR code, which the victim is enticed to scan with their…