North Korea’s QR Quishing: How Kimsuky Hackers Bypass MFA

On January 8, 2026, the FBI issued a stark warning regarding a sophisticated shift in tactics by the North Korean state-sponsored threat actor known as Kimsuky (APT43). The group is now aggressively deploying malicious QR codes—a tactic known as "quishing"—to bypass Multi-Factor Authentication (MFA) and hijack the cloud accounts of high-value targets, including US think tanks, academic institutions, and government entities.

By moving the attack vector from clickable links to scannable images, Kimsuky has found a way to exploit the gap between secure corporate workstations and less-protected mobile devices.

1. The Quishing Threat Emerges

According to the FBI’s IC3 alert, Kimsuky has been refining this technique since mid-2025. The group utilizes highly tailored spear-phishing emails that spoof government officials, policy advisors, or prominent journalists. These emails are specifically designed to entice experts on Korean Peninsula affairs into scanning a QR code for "urgent" or "exclusive" content.

Recent examples highlighted by security researchers include:

• May 2025: A think tank expert received an email promising regional insights, where the "confidential report" could only be accessed via a QR scan.
• June 2025: Academia was targeted with fake job offers or invitations to "urgent" virtual meetings, where the QR code served as the supposed login portal for a secure conferencing platform.

2. From Scan to Steal: How the Attack Works

The brilliance of the quishing attack lies in its ability to evade traditional security stacks. Most email filters are designed to scan text-based URLs and attachments; they often struggle to parse and analyze the destination of a QR code embedded in an image.

The step-by-step process follows a dangerous trajectory:

1. The Hook: The victim receives a spear-phishing email on their desktop. Because there is no "link" to click, the corporate URL scanner often marks the email as safe.
2. The Scan: The victim is prompted to scan the QR code with their mobile phone. This moves the interaction away from the monitored corporate PC to a personal or less-managed mobile device.
3. The Payload: The QR code leads to a sophisticated proxy site mimicking Microsoft 365, Okta, Google, or a corporate VPN login.
4. The Theft: As the victim enters their credentials, the site performs device fingerprinting and session cookie theft. By capturing the session token in real-time, the attackers can bypass MFA entirely, gaining persistent access to the victim’s cloud environment without triggering any suspicious login alerts.

3. Kimsuky’s Profile and Motives

Affiliated with North Korea’s Reconnaissance General Bureau (RGB) since at least 2012, Kimsuky (APT43) is the regime’s primary tool for geopolitical espionage. While the infamous Lazarus Group often focuses on high-stakes financial heists and cryptocurrency theft, Kimsuky’s primary mission is intelligence gathering.

Their goals include:

• Policy Intelligence: Stealing non-public data on sanctions, nuclear policy, and foreign relations.
• Persistence: Maintaining long-term access to mailboxes to monitor communications.
• Secondary Phishing: Using compromised "trusted" accounts to launch further attacks against other high-ranking officials.

4. Why QR Codes Succeed

The success of quishing is rooted in both technical and psychological factors. Corporate PC policies are often stringent, but mobile devices frequently lack robust endpoint detection and response (EDR) or mobile device management (MDM) filters.

Furthermore, this tactic represents an evolution of Kimsuky’s previous "DocSwap" malware campaigns from 2025, which used QR codes to deliver malicious Android APKs under the guise of Seoul-based logistics firms. By shifting from malware to session theft, they have made the attack "fileless" and significantly harder to detect.

5. Mitigations and FBI Tips

To combat this rising wave of quishing, the FBI and security firms like Bitdefender recommend a multi-layered defense:

• User Training: Educate employees that QR codes in emails are a high-risk red flag. Organizations should encourage a "never scan" policy for internal authentication.
• Technical Controls: Implement email security solutions capable of "image OCR" (Optical Character Recognition) to extract and analyze URLs hidden within QR codes.
• FIDO2 Authentication: Move away from SMS or push-based MFA toward hardware keys or Passkeys (FIDO2), which are resistant to the session-proxying techniques used by Kimsuky.
• Behavioral Monitoring: Hunt for Anomalous MFA/M365 logins and monitor for session replay Indicators of Compromise (IOCs).

6. Broader Implications and Outlook

The rise of quishing is a symptom of a broader trend: as AI-powered email filters get better at catching malicious text, state-sponsored actors are pivoting to visual and social engineering. North Korean cyber operations remain a vital pillar for the regime, providing both the intelligence and the funds necessary to bypass international sanctions.

As we look toward the remainder of 2026, organizations must rethink MFA. Relying on the assumption that "the second factor is secure" is no longer enough. In the age of quishing, a single scan can be the difference between a secure perimeter and a total cloud hijack.