ECH adoption is low, but risks remain for enterprises and users.

Encrypted Client Hello (ECH) is a security protocol designed to increase user privacy by encrypting the content exchanged between clients and servers when they are establishing a connection. Increased user privacy: what’s not to like?

Unfortunately, in the view of many enterprise security professionals, the increased privacy promised by ECH could simultaneously reduce their ability to detect and respond to threats. Widespread adoption of the security protocol would severely curtail the ability of enterprises to identify and block connections to malicious domains.

Late last year, our team at Corrata noticed an uptick in detections of an ECH domain. The numbers were small, low thousands among hundreds of millions of domain scans, but nonetheless intriguing. Did this herald the primetime arrival of ECH? Would widely-used security tools soon be blind to large swaths of internet traffic?

How ECH works

You’ve seen the padlock symbol and https designation in the address bar of your browser. Both are indications that the website you’re visiting uses the Transport Layer Security (TLS) internet encryption standard, which protects communications between an endpoint device and a web server. The vast majority of internet traffic uses the TLS 1.3 standard: ECH was designed as an extension to that standard.

Without ECH, a client will reveal the domain of the website it’s attempting to visit before the encrypted connection is established. This means that any entity that can see the user’s internet traffic, such as mobile operators, Internet Service Providers (ISPs), enterprise security teams and bad actors, can see their destination, even when the user and the server take precautions to avoid this.

ECH encrypts the entire Client Hello message (the first message sent by a client in a TLS handshake) so that only the gateway to the intended server, which holds the corresponding private key, can decrypt this inner message and complete the handshake securely. Network observers can no longer see which specific domain a user is trying to access.

Why does that matter?

Important cybersecurity tools like Secure Web Gateways and Next Generation Firewalls rely on that visibility to detect and block access to content that could represent a threat, such as phishing or malware download sites. Beyond security teams, ISPs have a commercial interest in understanding how their subscribers use the internet, and governments want to be able to passively monitor and potentially restrict access to illegal, malicious, or unacceptable content.

The visibility is particularly important for banks and other heavily regulated industries that are often required to monitor their incoming and outgoing internet traffic. As it stands, these organizations can decrypt traffic selectively without looking at sensitive data like employee PII or health records. But if ECH blocks filtering tools, banks will have to decrypt all internet traffic in order to remain compliant with regulations: degrading user privacy in the process.

ECH adoption is low, but risks remain for enterprises and users

Our analysis of the adoption and impact of ECH for enterprise users brought good news and bad news. Although overall adoption is very low (more than 9% of the top 1 million domains are ECH-enabled, but less than .01% of TLS connections used the protocol), malicious actors are already taking advantage of the anonymity the protocol provides: 17% of all ECH-enabled sites are risky. Chrome users with encrypted DNS enabled are most at risk.

You might wonder if such a small portion of internet traffic matters. If less than one-tenth of one percent of internet connections are using ECH, should enterprise security teams even worry about the protocol’s potential risks?

The short answer is yes.

To work, ECH requires traffic to flow through a content delivery network (CDN) that supports the protocol. Cloudflare is currently the only CDN that supports ECH, and the company has played an important role in driving ECH adoption. (Notably, Apple’s iOS does not support ECH.)

We found that over 90% of phishing detections use Cloudflare infrastructure. In addition to the ECH anonymity, these sites take advantage of other Cloudflare features. For example, the “captcha” page can direct desktop traffic to a legitimate site while mobile traffic is sent to a fake one.

We should expect ECH to grow in popularity over time, because there are opportunities and incentives for both the server side and client side to drive adoption. On the client side, Safari could support the standard or Chrome could enable encrypted DNS by default.

Server side

On the server side, you would need to see wholesale migration to Cloudflare (unlikely) or default support from other CDNs. It’s worth noting that ECH adoption is a positive for the CDNs. The complexity of implementation means more websites will opt to use CDN services: and the CDNs would become the only infrastructure players with widespread visibility of internet traffic.

For now, security teams can breathe a sigh of relief because the community’s fears that enterprise internet traffic would go dark are not yet being realized. But it would be irresponsible to expect this to continue long-term, given the significant market opportunities that ECH adoption offers for the CDN industry. The threat posed by the protocol must be taken seriously.

Tracking ECH and its cloak of secrecy is no longer optional for enterprise security teams. Our data shows that while the potential certainly exists for ECH to become a thorn in the side of defenders, this is the time to prepare rather than panic.

This article was produced as part of TechRadarPro’s Expert Insights channel.

The post Is a new privacy protocol helping malicious actors more than internet users? appeared first on Corrata.

Spear phishing is one of the most effective, widely deployed, and damaging cyberattack techniques. Unlike traditional phishing, which casts a wide net, spear phishing is a targeted and sophisticated form of social engineering. The threat is significant: in 2023, nearly 65% of organizations experienced spear phishing attacks. Attackers meticulously research their victims, often using personal details to craft convincing messages. Generative AI allows attacks to be cost-effectively scaled. The ubiquity of SMS and the explosion in the use of messaging apps has opened up a whole new range of delivery channels.

Unlike traditional phishing, which might involve sending hundreds or thousands of emails indiscriminately, spear phishing attacks are customized and designed with specific targets in mind. Attackers gather detailed information about a victim through social media, leaked data, or previous breaches, and then craft messages that appear legitimate. Mobile messaging apps have become central to spear phishing due to their widespread use for both personal and professional purposes.

SMS Phishing (Smishing)

Everyone is familiar with text messaging scams: fake parcel delivery notifications, warnings to update your banking details, or alerts to file for a tax refund. When targeting enterprises, the messages might involve urgent notifications to update your credentials or a message from a colleague sharing an important PDF. For example, a user might receive an SMS that appears to be from Microsoft365, alerting them to an “urgent security issue” with their account and instructing them to verify their login details on a fraudulent website designed to steal their credentials.

Smishing attacks are highly effective in corporate environments. Employees are accustomed to receiving legitimate notifications, making it easier for attackers to deceive them. The distribution of verification codes as part of MFA, though on the wane, has led many employees to view this channel as in some sense secure.

Messaging Apps

Messaging platforms like WhatsApp, Facebook Messenger, Signal, and Telegram are fertile ground for spear phishing. These platforms have billions of users, and attackers can impersonate known contacts to build trust. In many cases, attackers will convince the target to take specific actions, such as sending money, providing sensitive information, or clicking on a malicious link.

Since many people use these platforms for both personal and professional communication, the lines between work and private life blur, making it easier for attackers to exploit these communication channels. The end-to-end encryption provided by platforms like WhatsApp offers privacy but makes it harder to detect malicious activity, as security solutions may not be able to inspect the content of the messages.

Email

Even with the best email filtering solution in place, some phishing messages will reach your employee’s inbox. When viewed on a mobile phone, it’s more challenging for employees to spot clues that might alert them to a phish. Smaller screens with less detailed information make it easier for a phishing attempt to slip through unnoticed.

A subtle point about spear phishing is that it doesn’t necessarily target the employee’s corporate email address. Attackers can evade email phishing filters deployed by the enterprise by communicating with a target over their personal email account, perhaps with information about a new role.

What Are Attackers After in Spear Phishing Attacks?

In general, mobile phones cannot be used to move laterally within an enterprise network. There are, nonetheless, a host of bad things that attackers can accomplish with a successful mobile attack. An attack can be used to gain access to cloud systems by successfully harvesting credentials and/or session cookies. An attacker might also use mobile messaging channels to initiate a fraudulent payment, extract compromising personal information, or trick the target into sharing sensitive documents. The exfiltration of intellectual property, trade secrets, or classified information is often the aim of nation-state attackers. Spear phishing is commonly used by commercial spyware vendors to get remote access to target devices for purposes of surveillance or data extraction.

Conclusion

The combination of constant connectivity, access to sensitive information, and weaker security measures creates vulnerabilities that spear phishers can easily exploit. The smaller screens of mobile devices make it harder for users to spot phishing indicators, such as slightly altered email addresses or fake links. Additionally, people are more likely to interact with their phones on the go, often leading to quicker, less cautious decision-making. Users may also neglect basic security hygiene, such as enabling multi-factor authentication (MFA) or keeping devices updated, making them more susceptible to phishing attacks. And finally, mobile devices often lack the robust security tools found on desktop environments, such as antivirus software and phishing filters.

In our experience, this last point is underappreciated among Information Security professionals. Incident response specialist Mandiant’s most recent annual review highlighted attackers’ increased focus on evasion. They specifically called out attackers’ use of social media, SMS, and other messaging platforms to deliver lures to targets: methods that bypass traditional defenses. Often, mobile specialists will reassure the InfoSec team that the use of MDM and MAM means all is in order. InfoSec professionals are then surprised to discover that MDM does not scan for malware or protect against malicious links: basic controls that they rely on in the desktop world. It’s now clear that there’s an urgent need for InfoSec teams to end the neglect of mobile defenses. In part two of this series, we’ll explain how inadequate protections in mobile networks, operating systems and browsers leave your organization exposed.

The post No Filter – Part One appeared first on Corrata.

In a recent cybersecurity incident a sophisticated phishing attack was unveiled, employing QR codes as the primary tool for deception. This case study not only sheds light on the evolving tactics used by cyber attackers but also emphasises the crucial role of mobile security in thwarting such threats.

An organisation fell prey to a phishing scheme orchestrated through emails that appeared to be from a known supplier. Unbeknownst to the organisation, the supplier’s email account had been compromised. The phishing emails stood out because they instructed employees to scan a QR code to view details of an alleged outstanding invoice. This QR code, however, redirected the victims to a counterfeit login page designed to harvest Microsoft365 credentials.

Why QR Codes?

The choice of QR codes by the attackers was strategic and based on two key insights:

• Under-the-Radar: Many anti-phishing systems integrated into email services or offered by specialized providers overlook the verification of links embedded in QR codes. This oversight presents a loophole that the attackers exploited, sidestepping traditional email scanning measures.
• Bypassing Desktop Security: By encouraging targets to use their mobile phones to access the malicious site, the attackers effectively bypassed web filters and firewalls typically in place to protect laptops and desktops. This tactic demonstrates a deep understanding of the typical security infrastructure and its vulnerabilities.

Example of QR code phishing email

An Integrated Defence

Fortunately, the targeted organisation had previously implemented Corrata’s mobile threat defence solution. Corrata ZDP (zero day protection), a key element of Corrata MTD, identified the previously unseen link as suspicious, successfully blocked access to the malicious link and alerting the Security Operations Team through an automated integration with their SIEM, Google Chronicle. The response was swift and comprehensive:

• The Security Operations Team initiated an automatic process to filter out all related phishing emails from user inboxes, significantly reducing the risk of further compromise.
• Affected employees were alerted about the phishing attempt, and a mandatory password reset was enforced for all targeted accounts to mitigate any potential security breaches.
• The organisation also took the responsible step of informing its supplier about the email account compromise, closing the loop on the immediate threat and potentially preventing further attacks.

Lessons Learned and the Path Forward

This incident is a stark reminder of the continuous evolution of cyber threats and the importance of staying one step ahead. It highlights not just the value of a robust mobile threat defence solution but also the critical need for integrating such solutions into the broader security operations technology stack.

Key takeaways for organisations looking to bolster their cybersecurity posture include:

• Vigilance against sophisticated phishing tactics: As attackers get more creative, awareness and education on new phishing techniques are paramount.
• Comprehensive security measures: Beyond traditional desktop and network security, mobile threat defence is a critical layer that organisations must not overlook.
• Integrated security approach: Seamless integration between different security solutions enhances the ability to detect and respond to threats swiftly and effectively.

In conclusion, this case study serves as a powerful example of how modern attackers seek to exploit gaps in defences and the indispensable role of integrated, advanced security measures in protecting against sophisticated cyber threats. As we navigate an increasingly digital world, such proactive and comprehensive security strategies will be key to safeguarding valuable data and maintaining trust in the digital ecosystem.

The post Uncovering a sophisticated QR code attack appeared first on Corrata.

Scan with Caution

For years, our defences against phishing have focused on the familiar. We scan URLs, filter spam from our inboxes, and train ourselves to spot suspicious links by eye. But attackers keep changing tactics. They keep finding new ways to exploit our trust in everyday technology. Their latest trick? QR code phishing, sometimes called quishing. It targets a device most phishing tools ignore: the phone in your pocket.

The Unseen Threat: QR Code Phishing

A recent incident brought to light a particularly sophisticated phishing threat, cloaked behind the seemingly innocuous facade of a QR code. This malicious campaign began with an email-delivered document purporting to be an unpaid invoice, a lure chosen precisely because invoices carry a sense of urgency and routine that discourages close scrutiny. To access supposedly redacted information, the document prompted users to scan a QR code.

Unlike URLs, QR codes are often given a free pass by traditional phishing protection systems, which are not designed to scan a code’s embedded content for threats. This oversight, combined with the absence of a visible URL, means users may never question the legitimacy of the code. There is nothing to hover over, nothing to read, and nothing that looks obviously wrong, which makes the scam far more difficult to detect at first glance.

Unfolding the Scam

Those who scanned the QR code were redirected to a Cloudflare verification page, a common tactic used by threat actors to thwart both dynamic and static analysis by security systems. This step requires human interaction, and that single requirement does a great deal of work for the attacker. Automated crawlers and sandboxes cannot easily click through it, so the phishing site remains under the radar of automated defences for longer than it otherwise would.

Upon navigating the Cloudflare hurdle, users encountered a fake Microsoft login page asking them to enter their credentials. This is a classic phishing move designed to steal sensitive information. Because the page mimicked a service the victim already trusted and used daily, many would enter their username and password without a second thought, handing the attacker exactly what they were after.

The Takeaway

This incident is a stark reminder of the continuous need for vigilance, and of the importance of extending security protections to all endpoints. Attackers are increasingly exploiting the often lacklustre protection on mobile devices, spotting a gap they can exploit. Desktops and laptops tend to sit behind layered corporate defences, whereas phones frequently do not, and that imbalance is precisely what this campaign was built to exploit. QR codes, offering convenience and efficiency, have become a double-edged sword, providing cybercriminals with new opportunities to launch their attacks.

Corrata’s security solution immediately identified the threat posed by the newly registered domain. Our Zero Day Protection swiftly blocked the suspicious domain and alerted the administrators. Upon further analysis, the domain was reclassified as a phishing site.

The Evolution of QR Code Phishing

The lure in this campaign was a straightforward QR image sitting in a PDF. Attackers have since moved on to constructions built specifically to defeat the scanners that eventually learned to read them. Barracuda documented split QR codes in 2025, where the payload is fragmented across several images or pages so that no single element decodes to anything meaningful, and nested codes concealed inside other visual layers.

More awkward still are Unicode block-character constructions, which render a scannable pattern out of text characters rather than an image, so there is no picture for an image-based decoder to find in the first place.

Others simply change the container: one campaign in early 2026 hid encoded phishing URLs inside BMP attachments, which passed SPF, DKIM and DMARC and reached inboxes with the payload structurally invisible to every text-based control in the delivery path.

The pattern holds across all of them. Whatever the gateway has learned to parse, the next iteration puts the URL somewhere it is not looking, and the phone camera decodes it regardless.

How to Protect Yourself from QR Code Phishing

Defending against quishing does not require exotic tools so much as a shift in habits and a widening of coverage to the mobile device. A few practical measures go a long way.

Treat unexpected QR codes with the same suspicion you would give an unexpected link. If a code arrives in an email, particularly one attached to an invoice, a delivery notice, or a payment request, pause before scanning. Ask whether you were expecting it and whether the sender is who they claim to be.

Preview the destination before you commit. Most modern phone cameras display the underlying URL when they detect a code. Read it carefully, watch for misspelled brand names or odd domains, and do not proceed if anything looks off.

Never enter credentials on a page reached through a scanned code. Legitimate services rarely, if ever, ask you to log in this way. If you genuinely need to access an account, close the page and navigate to the site directly through your browser or app instead.

Enable multi-factor authentication wherever it is offered. Even if an attacker captures your password on a convincing fake login page, a second factor gives you a crucial extra layer of defence that can stop the intrusion in its tracks.

Extend security to mobile. The core lesson of this campaign is that the phone is now a front line. Endpoint protection that inspects the content behind a QR code, rather than merely the visible parts of a message, closes the gap that these attacks depend on.

Stay ahead of Cybercriminals

Corrata’s Mobile Security solution continues to monitor and defend against the ever-changing tactics of cybercriminals. By understanding the methods that attackers use, and by implementing advanced security measures across every device rather than only the traditional ones, we can stay one step ahead.

Threat Advisory

The post QR Codes – Sidestepping cyberdefenses appeared first on Corrata.

If, like the founding team at Corrata, you’ve been working in the mobile space since the dawn of the smartphone age, you’ll fully appreciate that the most critical messaging channel on a mobile phone is not the email inbox but the messaging client. You’ll also understand that the messaging client has only whatever protection your carrier, Google, Apple, or Samsung choose to provide. And as a mobile security professional you’ll question whether relying on consumer-grade protections is an acceptable strategy when it comes to your organization’s data.

To answer this question it’s important to understand the evolving mobile messaging landscape. Many of you will have heard the announcement from Apple that they plan on enabling interoperability between iMessage and the RCS messaging standard increasingly found on Android devices. The RCS (Rich Communication Services) standard has supplanted SMS and MMS on many more recent Android devices. RCS, while offering a messaging experience more akin to WhatsApp than traditional mobile messaging, has not been without its issues. In 2022 RCS services were halted in India due to a deluge of spam. RCS spam has also recently spiked in the US. In the light of these changes it’s worth reviewing not just the evolution of mobile messaging but also how these changes are impacting it as a threat vector.

In the beginning

In the beginning there was only SMS.  SMS is not an IP based messaging protocol. Instead it uses spare resources on the SS7 layer of the telecommunications network. The Short Messaging Service, to give it its full name, debuted in the early 1990s. Nokia’s implementation of the messaging client was particularly successful and contributed to explosive growth both for Nokia and for SMS. By the early 2000s people were sending billions of messages every year. Each New Year’s eve would bring new records in the number of greetings sent by text, threatening to tear down entire mobile networks in the process.

Initially SMS messaging was device to device. This limited its vulnerability to fraud: there was a physical limit on the number of messages which a mobile device could send. What’s more, per message charging meant that the economics of email spam didn’t apply to SMS. This gradually changed with the growth of application to person messaging (also known as wholesale or bulk messaging). A2P messaging was driven by ringtone distribution and voting on reality TV shows such as Big Brother and American Idol. Wholesale messaging was quickly recognised as a money spinner by mobile carriers who opened up their infrastructure to capture the new revenue streams. The decentralized nature of the mobile telecoms system (there are over 750 mobile carriers worldwide) has made it impossible to block spam and other malicious content. The reality is that there will never be an end to SMS based fraud at the network level.

Enter iMessage and RCS

There is nonetheless reason for hope as new IP based messaging systems developed or delivered by Google and Apple start to grab market share. iPhone users will be familiar with iMessage. Today iMessage only works between two Apple users. Apple users can also use iMessage to communicate with a business (Apple Messages for Business) but such communication must be initiated by the end users.

A newer Kid On The Block is Android’s RCS based messaging system. RCS is an operator developed standard which was designed as an evolution of SMS/MMS. It incorporates richer messaging features such as sending files, engaging in chats and responding with emojis. In other words, all of the features that we know and love from popular messaging applications such as WhatsApp.

Initially, RCS was completely unsuccessful due to a failure by carriers to launch the service. Now Google has taken the lead and has developed a successful RCS ecosystem. Using the Google messaging app, or in some cases the built in messaging app, you can send RCS messages to other Android users. Apple’s recent decision to support interoperability between iMessage and RCS is a game changer though it is unlikely that SMS will ever completely disappear (neither Google nor Apple have any plans to stop supporting it).

Anti-spam/Anti-phishing

Security around the RCS/iMessage environment has a number of important elements. Earlier this year Google introduced end to end encryption for RCS messages sent between two Google messaging clients. Google also verifies senders and filters A2P messages sent via its wholesale RCS Business Messaging (RMB) service. These messages, are not end to end encrypted, allowing Google to examine content for signs of fraud or other mis-use. What’s more in contrast with SMS, with RCS there’s effectively a single gatekeeper on wholesale messaging. Messages for Business is Apple’s equivalent to RMB. Critically, from an anti-spam/anti-phishing perspective, Messages for Business only works where an end user initiates an interaction by, for example, directing a question to an online support chat service.

The other important element is the spam filtering performed by the messaging client. This attempts to filter out spam messages which arrive on the device. Google’s messaging client appears to be very effective in this area. iMessage on the other hand has much weaker capability. And the messaging clients provided by phone manufacturers (which are often the default option on Android) provide only very patchy filtering.

Looking to the future

This of course begs the question as to how malicious messages are still ending up on devices notwithstanding Google inspection of wholesale messages. We believe that cyber criminals are bypassing this control by sending messages directly from devices (or more likely dozens of phones racked). End to end encryption makes centralized scrutiny of these messages impossible. What’s more, because the messages are IP based they cost nothing to send and can be sent in large numbers even without a wholesale connection to the service. For these reasons alone we have to expect that message based fraud will remain a viable option for determined attackers targeting high value opportunities. The publication of pypush, an open source proof of concept library that enables any type of computer to send and receive end-to-end encrypted messages over the iMessage protocol, demonstrates that it will also remain relatively easy to push malicious content into the iMessage environment notwithstanding Apple’s efforts.

The widespread adoption of RCS and its interoperability with iMessage will, we believe, significantly reduce consumer focused messaging fraud. In particular, improved spam filters on messaging clients will reduce the incidence of messaging scams reaching the end user. Ironically this will make the messaging channel an even more attractive option for the kind of targeted phishing attack which we see being launched against high value targets. Ultimately we face a future where messaging spam becomes less prevalent but targeted phishing attacks over the mobile channel remain a serious concern.

The post The most dangerous app on your phone appeared first on Corrata.

QR code phishing, usually shortened to quishing, arrives addressed to one security team and lands on a device looked after by another. The message comes in through email, where inspection is heaviest. But the scan happens on a phone, which in most organisations sits outside the controls protecting everything else. Neither team is being careless. The technique crosses a boundary that most security programmes were not built to cover.

That boundary is what keeps quishing worth an attacker’s time, and it explains why treating it as an email problem tends not to resolve it.

What is quishing?

Quishing is phishing in which the malicious link is hidden inside a QR code rather than written as text. The attacker delivers a code by email, in a message, or on something printed, and the recipient scans it with a phone camera. The code resolves to a web address the recipient cannot read in advance, usually a counterfeit login page built to capture credentials. The objective is the same as any credential phishing attack. What changes is the delivery, and that change matters, because a QR code is an image, so a tool that inspects text does not see a link at all.

The word is a contraction of QR and phishing. Some practitioners object to it on the grounds that it describes ordinary phishing with an extra step, which is fair as taxonomy. The distinction still earns its keep operationally, because the controls that catch a text link are not the controls that catch an image.

The security risks of QR codes

A QR code is a two-dimensional barcode that resolves to a web address when scanned. Two properties of that design are what an attacker makes use of:

The destination is not visible on the code: There is no text to inspect, so nobody can tell where a code leads before scanning it. Most phone cameras will preview the resolved address before the page opens, which helps, but the preview arrives after the decision to scan has already been taken.

The code cannot be verified: QR codes are not signed or encrypted by default, so nothing distinguishes an original from one that has been altered or replaced. A tampered code looks the same as an untampered one.

Together those properties mean the usual advice does not transfer. An employee trained to hover over a link and read the domain before clicking has no equivalent move available. There is nothing to hover over and nothing to read. The check has to move to the moment the page opens, rather than the moment before the scan.

The same properties that defeat the human check also defeat the automated one.

Why quishing gets past email security

Secure email gateways were built to parse text. They read headers, body copy and addresses, then check what they find against reputation data. A QR code offers none of that. The destination sits encoded in pixels, and unless the gateway renders the image and decodes it, there is nothing for the engine to match against.

Cyble’s research team tracked one quishing campaign, which it named Scanception, and identified more than 600 unique phishing PDFs and emails over three months. Nearly 80% of the PDFs it examined had no detections at all on VirusTotal at the time of analysis.

Attachments make this harder still. A code inside a PDF is an image inside a file, two removes from a text scanner. Cyble also observed lures that grew from a single page to several, which defeats tools configured to inspect only the opening page of a document.

We take that evasion chain apart step by step in how QR codes evade email security gateways.

Where the code comes from

Four delivery patterns account for most of what we see.

In an email attachment: This is now close to the whole picture for email-delivered codes, and the file type keeps moving. Microsoft found PDFs carrying 79% of QR code attacks in April 2026, falling to 58% by June, while Word documents rose to 40% over the same period. It notes that operators have swapped between the two formats repeatedly across the past year. Codes placed directly in the email body went the other way, surging in March to 5% of attacks and then falling to near zero across the second quarter.

That rotation is worth dwelling on, because it is an argument against detection tuned to a file format. A control that learned to open PDFs in April was looking in the wrong place by June. The pretext is steadier than the container: something routine carrying mild urgency, such as an unpaid invoice, a payroll notice or a document said to need review. Routine is the point, because it discourages close reading.

Pasted over a legitimate code: Because a printed code cannot be verified, replacing one is a matter of a sticker. Parking meters, menus and posters have all been used this way.

On a screen, to move the target onto a phone: Codes increasingly appear on desktop displays as a way of linking a computer session to a mobile one. Signing in to WhatsApp on a laptop works this way. Attackers use the same handoff to get a session onto a device with weaker controls.

In messaging apps and SMS: A code sent as an image in a chat inherits the trust of the channel and of the sender, particularly where the sender’s own account has been taken over.

Why the phone is where this lands

A corporate laptop generally sits behind a firewall, DNS filtering, a web proxy and endpoint detection, with conditional access governing what it can reach. A phone often has none of that, and a personal phone used for work almost never does.

Microsoft’s assessment is that the scan tends to move the victim onto a mobile device the organisation does not manage, and that this is part of why QR codes have become a favoured tool for actors trying to get past email defences. Cyble noted that Scanception moved the point of compromise onto unmanaged mobile devices, outside the corporate perimeter. That is not incidental to the attack. It is the reason the attack is built this way.

Two smaller factors compound it. A decade of legitimate use has trained people to scan without deliberating. And a handset shows less of an address than a monitor does, so a lookalike domain that would stand out on a desktop can pass unremarked.

Why multi-factor authentication does not close the gap

Where the counterfeit page operates as an adversary-in-the-middle proxy, it relays the login in real time. The password and the second factor both pass through to the genuine service, and the attacker retains the resulting session token.

Cyble observed adversary-in-the-middle pages in the Scanception campaign. Multi-factor authentication still raises an attacker’s costs and should stay switched on, but it does not by itself answer this technique.

How to defend against quishing

Two layers, and the second is the one most organisations are missing.

What people can do: Treat an unexpected code the way you would treat an unexpected link, and pause before scanning one that arrives with an invoice or a payment request. Read the address your camera previews before opening it. Decline to enter credentials on any page reached by scanning, and navigate to the service directly instead. On printed codes, look for a sticker edge or a raised corner.

What controls can do: Awareness alone leaves the outcome resting on one person’s judgement at one moment. Closing the gap means inspecting traffic on the device where the code opens. Corrata inspects that traffic on the phone itself, filtering against mobile-specific phishing intelligence. Previously unseen domains are quarantined until their reputation can be established, which is what catches a domain registered hours before a campaign starts. Detections raise an alert to the security team through the organisation’s existing SIEM.

Read more about blocking malicious links behind scanned QR codes, or see the sequence play out in a compromised supplier account used to deliver a QR code.

In the demonstration above, a scanned code opens a counterfeit of the eBay sign-in page, distinguishable from the real one only by its address. With Corrata running, the page does not load and the user is told a threat was detected.

See this on your own devices

The same inspection applies to any scanned code, whether it arrives in an attachment, in a message, or on something printed. If you want to see how it behaves on your organisation’s phones, get in touch.

Request a demo

Frequently asked questions

What is quishing?

Quishing is phishing that hides the malicious link inside a QR code instead of writing it as text. The victim scans the code with a phone and lands on a counterfeit page, usually one built to capture login credentials.

Is quishing different from phishing?

The objective is identical. Only the delivery differs. Because the link is an image rather than text, it evades scanning tools that read text, and because it is scanned with a camera it typically opens on a phone rather than a managed computer.

Can email security stop QR code phishing?

Not reliably. Gateways that parse text cannot read an address encoded in an image. Cyble found that nearly 80% of the QR-bearing phishing PDFs in one campaign had no VirusTotal detections at the time of analysis.

Does multi-factor authentication protect against quishing?

It helps but does not settle the matter. A counterfeit page running as an adversary-in-the-middle proxy passes both the password and the second factor to the real service and keeps the session token.

How can I tell whether a QR code is malicious before scanning it?

You cannot read the destination from the code itself, so the check has to happen as the page is about to open. Most phone cameras preview the resolved address first, so read it before proceeding, and treat an unexpected code the way you would an unexpected link. On printed codes, look for signs that a sticker has been applied over the original.

The post QR Code Phishing (Quishing): What it is and How to Stop it appeared first on Corrata.

Corrata observed a sms phishing scam targeting Irish mobile users “in the wild.” The attack itself was designed to harvest credit card credentials, but what made it noteworthy were techniques which were designed to prevent automated anti-phishing engines from easily detecting it. 

Description

The following SMS message was received by users on Irish mobile networks.

Clicking on the link brought the user to the series of pages which are replicas of the Irish tax authorities website. 

Attacks of this type are not uncommon. We have noted that attackers have become much more adept at providing credible fake landing pages which are difficult to distinguish with the naked eye.

The video below shows how the user is guided through the website to the point where credit card details are requested. 

Avoiding detection

Fast detection is critical to defending users against such attacks. When a new domain is identified by a web-filtering or anti-phishing engine it is immediately subject to automated scanning to look for indicators that it might be malicious. This is especially the case when the domain is recently registered. 

The attackers behind the domain income-revenue-credit[.]com, however, used two techniques to try and avoid detection.

When the attack was first launched, only the first page was accessible. This was designed to make detection less likely. When a user pressed submit, nothing happened. 24 hours later, the fake website was fully operational.

The website was also designed to be non-responsive to queries from a desktop browser. As many phishing systems are designed to detect traditional email phishing, they rarely scan domains using a mobile browser. By being non-responsive to scanning, the phishing site effectively remained invisible.

Conclusion

Attackers are very aware of the sizeable resources which are being directly at disrupting their attacks and are constantly evolving their techniques to maximise the possibility that an attack will reach their intended victims. For them, it’s a funnel from delivery through to success which they look to optimize constantly. The kind of techniques which Corrata observed in this attack will no doubt evolve and mutate over time. The battle is constant.

The post Avoiding Detection appeared first on Corrata.

This week we launched our latest guide to mobile phishing. Phishing is the attack technique which is most widely used to target mobile users. It is also an attack that organizations are almost certain to encounter.

Phishing on mobile presents unique challenges both to employees and to InfoSec professionals. Our guide provides a comprehensive review of the challenges and offers in-depth guidance for defenders. You can download the whitepaper here.

The Mobile Phishing Threat

Every organization that takes cybersecurity seriously takes steps to combat phishing. These include training end users, deploying anti-phishing technology, and running simulated attacks to reinforce learnings. Notwithstanding this, phishing remains one of the most potent forms of cyberattack:  according to an authoritative survey by Cisco, 90% of data breaches involve phishing.

Traditionally phishing has been a social engineering attack associated exclusively with email. But this has changed with the rapid growth of messaging and collaboration apps on mobile devices. Today only 15% of phishing attacks targeting mobile users are executed are delivered by email: 85% are delivered by SMS, WhatsApp, Slack, LinkedIn, or other social media apps.

Some of the many mobile phishing channels

Such attacks are particularly dangerous for two reasons. The first reason is that end-users are more likely to fall for phishing attacks on mobile than on laptops or desktops. This is because smaller screens make it harder to spot visual clues and because people use phones in a more casual, less vigilant manner.

The second thing that causes mobile phishing to be particularly dangerous is the absence of protection. Enterprise email services have anti-phishing protection built-in. And many organizations choose to deploy additional technical solutions to catch those attacks which such built-in protection misses. Web-filtering technology also helps by providing a further layer of defense if a phishing email avoids detection.

None of these protections exist on phones or tablets. SMS, WhatsApp, and other messages arrive on the user’s phone effectively unfiltered. And when links are clicked, no web-filtering system kicks in.

Phishing In The Cloud

The transition to cloud applications has led to a fundamental change in the risk profile of mobile devices. In the past many critical applications were not accessible over mobile devices. In fact, for many employees, mobile meant email and little else. As a result, the attack surface exposed on a mobile was dramatically less than on a desktop or laptop.

With the growth of cloud apps, that situation has completely changed. Now almost every application used by an organization is accessible over mobile. Mobile devices have achieved parity with traditional endpoints. But without the same level of protection. An attacker is as likely to get credentials for a sensitive business system by targeting a mobile as a desktop.

Multi-factor authentication does provide a level of protection against both email and mobile phishing. However, it’s no panacea: recently, we’ve seen the emergence of toolkits which enable attackers to bypass MFA. These are now widely available and emphasize the need to guard against credential theft in the first instance.

Defenders’ Playbook

The good news is that mature, effective solutions are now available to defend against mobile phishing. Mobile endpoint security solutions (also known as Mobile Threat Defense solutions) include anti-phishing protection along with a range of other features to defend against data loss and malware and to manage vulnerabilities.

Specialist providers are particularly effective at blocking the latest attacks. And if you choose carefully, you can find solutions which are effective, but which don’t impact end-user experience or compromise privacy. 

The post Unprotected Txt appeared first on Corrata.

As a CISO, Security Architect, Risk Manager or Security Analyst, it’s your job to identify the best way to mitigate information security risk within your organization. Sometimes this will involve implementing a technical solution to protect against a new or growing threat. You will have come to this decision after examining the range of alternative approaches to addressing the threat and, in the case of a technical solution, having assessed multiple vendor offerings. 

But for many, this is the easy part. It’s essentially a technical issue, a question of diligence and expertise, likely conducted with peers who share your deep understanding and engagement with cybersecurity risks and technologies and the tradeoffs involved in any such decision. Now the time comes to bring your proposal to the upper management, perhaps the executive team or the Board. Now you need to articulate in terms that the non-technical will understand why your organization needs to spend time, money and resources on the project, aka – make the business case.

What then is the business case for investing in mobile endpoint security?

Why we need a mobile endpoint security solution now

The first question you must answer is, ‘Why now ?’ In other words, what has changed in the information security environment that makes it urgent to implement mobile endpoint security today? After all, employees have been using smartphones since the advent of the iPhone.

The reason why mobile endpoint security is a business priority today is straightforward. The move to cloud means that mobile users now have access to the same business systems that are available on traditional laptops and desktops. In the past, laptops and desktops had access to a much wider range of applications because they were joined to the corporate network either directly or through a VPN. Today that distinction is disappearing: all devices access cloud or SaaS applications on the same basis. 

This gives us our first argument for the need for mobile endpoint security:

“More and more of our business applications will be accessible directly from our employees’ phones and tablets:

– We are now using the Microsoft 365 suite, including Outlook, Teams, OneDrive, Word and Excel, all of which are accessible from employee mobiles.

– In the last two years, the organization has adopted a wide range of SaaS applications.

– We expect that the number of SaaS applications used by the business will continue to increase.”

Parity of protection

Your senior management is very aware that the organization has a range of security solutions in place to protect traditional endpoints. What they may not appreciate is that these solutions do not operate in the mobile environment. Web content is not filtered, mobile phishing messages are not blocked, and phones are not scanned for malware infection. 

This leads us to the second argument in support of mobile endpoint security – parity of protection:

“While we have an endpoint security solution deployed on desktops and laptops, we don’t have an equivalent protection on employee mobile devices. This means we have no protection against malicious content, phishing over sms and other messaging applications, and mobile malware.“

Mobile Devices are not invulnerable

85% of mobile phishing attacks are outside email. SMS, WhatsApp, and other messaging, social and collaboration platforms are all being targeted with increasingly sophisticated phishing attacks.

Based on data from the hundreds of organizations using Corrata, we know that most employees receive a mobile phishing message at least once a month. We also know that one in five devices have poor security configuration, making them susceptible to malware infection. And one third, access websites with weak encryption leaving employees exposed to data loss. Nothing in your mobile device management system addresses these threats. 

This leads us to the third argument in support of mobile endpoint security – heightened risk:

“There are a range of risks which are not addressed by the built-in security on iOS and Android or by our mobile device management system. These include:

– Targeted phishing attacks sent directly to mobiles over SMS, Whatsapp, Slack and other messaging and collaboration platforms.

– Attacks which bypass our multi-factor authentication by stealing authentication cookies. A successful attack would allow unauthorized access to our business systems over a prolonged period.

– Malicious software which allows attackers to read messages and other content sent to and from our employees’ phones.

– Poor encryption of data in transit leading to unauthorized disclosure of company and customer information sent to and from mobile devices.

– Non-compliance with acceptable use policy which restricts access to inappropriate content

– Failure to keep phone software up-to-date and other poor security configurations.”

How mobile endpoint security helps

You’ve made a strong set of arguments for the need to do something about the mobile security gap. You now need to introduce the solution. This means explaining what a mobile endpoint security solution will do. In doing this, it’s important to remember that your audience will assume it’s like the endpoint security solution with which they’re familiar – this might be a traditional anti-virus solution or a more modern EDR solution. Mobile endpoint security incorporates virus scanning and malware detection and response but also next-generation firewall, web-filtering, and anti-phishing features:

“The mobile endpoint security solution we’re proposing will protect us by doing the following:

• Blocking links to phishing sites, malware download sites, sites which are contrary to our acceptable use policy, and other malicious sites. It provides the equivalent of the web filtering we currently have on our desktops and laptops.
• Detecting any malware present on a device. Any device with malware installed is automatically prevented from accessing our business applications. This is equivalent to the [anti-virus, endpoint protection, or endpoint detection and response] software on our laptops and desktops.
• Preventing any data being sent to or from our phones without proper encryption. This ensures that our data cannot be snooped on by bad actors monitoring WiFi or other networks. This is equivalent to the protection provided by using a VPN.
• Assigning a security score to each device. Employees are prompted to keep their devices up to date, to remove any risky applications, and to correct any poor configurations. Devices with low scores can be automatically prevented from accessing business applications. This is equivalent to features provided by our endpoint protection software on laptops and desktops.”

No negative impact on employees

Having convinced your executive team of the need for a solution and the practical protections it will deliver, your final step is to address two common objections. The first relates to employee acceptance. Your senior managers will be only too aware that employees don’t like being surveilled. They also love their phones and don’t want anything interfering with the smooth functions of their devices. So it is important to be able to reassure your executives that the solution respects employee privacy and does so in a transparent and easy-to-communicate manner.

This means a solution that doesn’t track location, scan images or other content, read messages, or record browsing history.

You should also be able to offer the reassurance that your chosen solution runs unobtrusively in the background without impacting the normal operation of the device. Employees are only required to interact with the app in the rare case that their manual intervention is required to resolve a security issue.

Easy to deploy and needs little ongoing management

The second concern will be around the impact on the, undoubtedly stretched, security operations team. The good news is that mobile endpoint security focuses on preventing attacks: blocking phishing and malware download sites, preventing unencrypted communications, and disabling malware. Alerts and escalation requirements are generally minimal, and mature solutions will integrate with your existing security operations stack. 

The final clincher: quick and easy to deploy (and hence no upfront professional services costs), a single all-inclusive annual fee with no hidden extras.

In conclusion: you should approach your senior management with confidence. Mobile Endpoint Security is a cost-effective, easy to deploy and manage technology which addresses a gap in your defences which, unless addressed, will only get larger.

Best of luck! 

The post Making Your Case appeared first on Corrata.

As an IT leader in a legal firm, you don’t need to be told about how important Information Security is to your sector. Legal firms face unique challenges. They not alone handle client funds but also handle sensitive and highly confidential information. Handling of sensitive information is not the exception in legal firms, it’s the rule.

The range of potential attackers targeting legal firms is comparable to that facing governmental organizations, including nation-states, serious organized crime gangs, and hacktivists. Attackers are motivated not just by financial gain but also by political, ideological, and nation-state concerns. Incidents such as the release of the Panama and Paradise papers send a chill through the bones of legal firm Information Security staff everywhere. 

Risks are particularly acute for firms whose clients are in sensitive or controversial sectors such as energy, life sciences, capital markets, and high technology.  

Recent trends

Experts point to a range of recent trends which are heightening the risk profile of the legal industry:

• Clients challenge the technical capabilities of firms insisting that they support their preferred collaboration and data storage systems.
• The legal supply chain is becoming more complex: outsourcing, disaggregation of the delivery of legal services, and the increased use of specialist firms. Not alone must legal firms collaborate securely with their clients, but they must also do so with a range of other legal providers.
• Remote working has become the norm, and with it, the requirement that documents and systems be accessible from anywhere at any time in a manner which delivers both security and ease of use.
• Complex and often conflicting privacy regulations. For example, firms working with US clients may well need to take growing state-level privacy laws into account in their operations.

Supply chain attacks have raised awareness across all sectors that your data is only secure when the third-party suppliers you rely on have effective information security management systems. Clients demand insight into their legal service providers’ cybersecurity controls, processes, and procedures. They are acutely aware that the information they share with their lawyers is highly sensitive and need reassurance that it is being handled and protected appropriately. Firms need to credibly answer clients’ requests about their cyber security practices and their information security management system. Increasingly clients demand certifications such as ISO 27001 and SOC 2.

All of these factors point to the unique importance of information security to the reputation of legal firms. Partners are only too aware that a single incident can destroy a reputation carefully built up over countless years, and there are plenty of ready, willing, and able competitors just waiting for an incumbent to slip.

Information security leaders within legal firms are not complacent, and neither are their management. PWC UK’s Annual Law Firm Survey revealed that the top 100 firms have increased their spending on cybersecurity by an average of 39% in the last year.

The rise of mobile risk

But what if that spend is not properly allocated? Today many legal firms have no protection in place against the rising threats facing mobile users, even though we are now seeing a 50/50% split between mobile and desktop traffic – a significant change from the 25/75 split in 2015. As the profession embraces cloud computing, the exposure that mobile represents begins to align with the exposure with traditional domain-joined devices.  

Today, the vast majority of medium and large legal firms have mobile device management systems in place. In fact, many have had these systems in place for many years. However, the clue is in the name: these are management systems, not security systems. They don’t defend against the three principal risks facing mobile users today. 

The first of these is the risk of credential theft either via phishing attacks or malicious applications. 77% of leading law firms reported experiencing a phishing incident in 2022. These attacks are widespread and increasingly sophisticated. Not alone can they steal usernames and passwords but also authentication cookies and codes. MFA is not a panacea.

Advanced spyware is the second significant risk facing law firms, particularly those dealing with clients in sensitive sectors. Multiple scandals have raised awareness of security agencies’ use of the Pegasus iOS spyware to mount targeted surveillance on politicians and civil rights activists. Today there is mounting concern that similar sophisticated technology is being deployed more widely. Such malware bypasses the in-built security protections in iOS and Android and cannot be detected by anti-virus software. But the threat is real and can lead to a fundamental compromise of any data on the phone and create a gateway to all of the data in the organization.

The third risk is from intercepted communications. Lawyers use their smartphones and tablets continuously on networks which are not under their organization’s control. This can be anything from a home network to the free Wi-Fi provided in hotels or coffee shops or, indeed, the cellular network itself.  Without robust and continuous encryption, these communications are at risk of interception by determined adversaries.

A better set of solutions

It is, unfortunately, true that the first generation of mobile security solutions promised more than they delivered. Many were designed and based on replicating the limited features found in traditional anti-virus solutions. They failed to take into account the unique benefits (for example, sandboxing and the app store distribution model) and challenges (for example, smishing and user privacy expectations) of the mobile environment.

The good news is that there are easy-to-deploy, privacy-sensitive solutions available today. Mobile Threat Defence technology has moved on since the term was first coined by Gardiner back in 2016. Today leading-edge mobile threat defense solutions protect against SMS and other mobile-specific phishing attacks, are able to detect sophisticated malware and against communications which are inadequately encrypted. And what’s more, the leading solutions can do all of this without the need to collect privacy-sensitive information such as location or the contents of files on the device.

In Conclusion

I would urge legal firm IT leaders to carefully consider the benefits of deploying MTD. If you’ve previously looked at mobile endpoint security solutions, now is a good time to look again and if not, then take a look for the first time. You’ll be pleasantly surprised by the protections available, the positive user experience provided, and the ease of management and deployment. And you never know, but your partners might even thank you! 

The post Courts, Contracts, Cloud And Collaboration appeared first on Corrata.