Story perspectives

FBI Warns: Kimsuky Uses QR Codes for Phishing Attacks

1/9/2026

Summary

Story summary

The Federal Bureau of Investigation (FBI) warns that Kimsuky uses Quick Response (QR) codes in targeted spearphishing.
The campaigns target U.S. think tanks, academic institutions, and government officials involved in North Korean affairs.
Since May 2025, Kimsuky has sent emails with QR codes redirecting to fake login pages for Microsoft 365 and Okta to harvest credentials.
The FBI urges verification of QR sources and adoption of multi-layered security measures.

History

Historical Context

Kimsuky, a North Korean cyber group active since 2012, intensified its operations in 2025 by using QR codes for spearphishing attacks against U.S. think tanks and officials. This escalation reflects a growing trend of state-sponsored cyber threats, reminiscent of the 2016 Democratic National Committee hack, highlighting the urgent need for improved cybersecurity measures in vulnerable sectors.

1 of 2

Story summary

The Federal Bureau of Investigation (FBI) warns that Kimsuky uses Quick Response (QR) codes in targeted spearphishing.
The campaigns target U.S. think tanks, academic institutions, and government officials involved in North Korean affairs.
Since May 2025, Kimsuky has sent emails with QR codes redirecting to fake login pages for Microsoft 365 and Okta to harvest credentials.
The FBI urges verification of QR sources and adoption of multi-layered security measures.

1 / 2