Kaspersky Warns: Evolving QR Code Phishing Attacks

Discovering a New Era in Phishing: The Rise of Text-Based QR Code Attacks

Cybercriminals constantly evolve their tactics to bypass security measures, and the latest innovation in phishing attacks exemplifies this relentless arms race. Instead of relying solely on image-based QR codes, attackers now craft text-based QR codes—a subtle, sophisticated method designed to escape detection. This approach leverages the historical concept of ASCII art and adapts it for malicious purposes, creating a new frontier in cyber threats that demands heightened awareness and improved defensive strategies.

What Are Text-Based QR Codes and How Do They Work?

Traditional QR codes are graphical representations of encoded data, easily scanned by smartphones or dedicated readers. In contrast, text-based QR codes are composed of carefully arranged characters—letters, numbers, and symbols—that visually mimic the appearance of QR codes when formatted correctly. These textual representations use ASCII or Unicode characters to simulate standard QR patterns, tricking scanners and security systems into perceiving them as harmless text rather than embedded malicious links.

For example, attackers generate intricate ASCII art that, when interpreted by certain parsers or OCR tools, functions as a QR code. They embed malicious URLs or payloads within this text, which are then delivered via email or messaging platforms. When a victim scans or even visually inspects these text formations, they may unwittingly click links that lead to fraudulent websites or trigger malware downloads.

The Historical Roots and Modern Adaptation of ASCII Patterns

Back in the early days of computing, ASCII art was a popular method of creating visual content using keyboard characters. Historically, complex images and logos were rendered solely through text, due to the lack of graphical capabilities. Over time, cyberattackers repurposed this technique, transforming simple ASCII images into “text-based QR codes” that serve malicious purposes.

These textual images capitalize on the familiarity and simplicity of ASCII art to avoid detection by automated security scans that typically analyze image-based QR codes. Since many email security solutions rely on pattern recognition and URL filtering within images, text-based codes slip past unnoticed, creating a significant security blind spot.

How Attackers Exploit Text-Based QR Codes in Phishing Campaigns

In a typical campaign, attackers craft an email impersonating trusted entities like banks, government agencies, or corporate partners. Inside the message, they include a text-based QR code designed to appear as a normal part of the content. The victim receives instructions to scan this “画像” (image) for verification or document access, unaware that it is actually ASCII art with embedded malicious code.

• Embedding deceptive URLs: Malicious links are concealed within ASCII characters, making it difficult for automated tools to detect.
• Obfuscation techniques: Attackers use multiple line breaks, special characters, or distorted patterns to mimic legitimate QR codes visually while hiding their true intent.
• Target manipulation: Phishers often customize the ASCII art style to match the branding of the impersonated organization, increasing trustworthiness.

When the recipient scans the ASCII QR code, the device may decode the embedded URL or be tricked into visiting a fake login page, thereby harvesting sensitive credentials or installing malware.

Why Are Text-Based QR Codes So Difficult to Detect?

Most security solutions focus on analyzing the visual aspects of QR codes or scanning for known malicious URLs within images. Text-based QR codes, however, are composed entirely of alphanumeric characters, which makes them elusive. They don’t trigger standard image recognition algorithms and are often classified as normal text, allowing them to circumvent:

• Antivirus software
• Email gateways with URL filtering
• Automatic scan tools that target image-based codes

This means that organizations need to upgrade their defense strategies to include content analysis of text blocks, especially within suspicious emails or messages, to identify these covert threats.

Concrete Steps to Protect Yourself from Text-Based QR Code Phishing

Defense against this emerging threat requires a multi-layered approach:

1. Enhanced Email Security: Implement advanced email filtering solutions that analyze not just links but also embedded text patterns for anomalies or suspicious ASCII art.
2. User Awareness & Training: Educate employees and users about the existence of text-based QR codes and instruct them to scrutinize unfamiliar ASCII patterns closely, especially if they prompt scanning or clicking.
3. Manual Verification: Instead of blindly scanning QR codes from unexpected sources, verify their authenticity by contacting the sender directly through official channels.
4. Use Specialized Tools: Employ security tools capable of analyzing textual content for embedded malicious URLs or encoding schemes that resemble QR code patterns.
5. Stay Updated with Threat Intelligence: Regularly monitor cybersecurity advisories for emerging techniques like text-based QR codes and update your defenses accordingly.

Case Studies and Examples

Several security firms have documented instances where threat actors successfully employed text-based QR codes in targeted spear-phishing attacks. In one notable case, a financial organization received an email seemingly from a trusted partner containing a lengthy ASCII art pattern. When employees scanned the pattern, they were redirected to a counterfeit website resembling the company’s login portal. The attack succeeded because the ASCII art was crafted meticulously to mimic a legitimate QR code, escaping standard filters.

Another example involved a government agency recipient who received a message with a complex ASCII pattern, claiming to be a document attachment. Upon closer inspection, security experts identified it as a malicious text-based QR code, which, when decoded, pointed to a command-and-control server hosting malware variants.

Conclusion

The shift from visual to text-based QR codes represents a paradigm shift in phishing tactics, emphasizing the importance for organizations and individuals to remain vigilant. Recognizing that attackers exploit ASCII art’s simplicity and familiarity enables security teams to develop better detection methods. It is imperative to combine user awareness with technical safeguards to prevent falling prey to this innovative form of cyber deception, which blurs the line between legitimate content and malicious intent.