QR Code Phishing (Quishing), Atoro Parking Meter Stickers, ne URL ahorow a ɛyɛ hu¶

Quick Response (QR) koodu a wode wo smartphone mfoninitwa afiri hwehwɛ mu no abɛyɛ da biara da su a ɛyɛ adwuma ara kwa a wode tua kurow no mu mita ahorow a wɔde kar sisi ho ka, wofi ase de anyinam ahoɔden kar (EV) charge stations fi ase, hwɛ adidibea menu ahorow, di nneɛma a wɔde kɔma wo akyi, na wowie adwumakuw no multi-factor authentication (MFA). Ahunahunafo de saa ahotoso a ɛda adi pefee yi di dwuma denam Quishing (QR Code Phishing) so: wɔde honam fam vinyl QR decals a ɛnyɛ nokware a wɔde hyɛ sticker ahorow a ɛfata so tẽẽ wɔ ɔmanfo kar gyinabea kiosks so, de atoro "missed delivery" postcards mena, anaasɛ wɔde QR mfonini ahorow a wɔayɛ no nnam hyehyɛ nnwumakuw PDF ahorow mu de twa adwumayɛbea email a ahobammɔ wom apon ho.

Esiane sɛ QR code yɛ data a wɔde optically encoded ayɛ ara kwa, a etumi kura alphanumeric nkyerɛwde 4,296 nti, w’ani ntumi nhwehwɛ URL a wode rekɔ no mu ansa na wode wo mfoninitwa afiri no akyerɛ matrix no. Nea enye koraa no, sɛ wo scan QR code a, ɛdan ntua no fi w’adwumakuw laptop a wɔhwɛ so kɛse no so kɔ w’ankasa smartphone so, baabi a mobile browser address bars twa subdomains atenten no mu na Adversary-in-the-Middle (AiTM) reverse proxyes betumi akyere wo credit card, Apple Pay / Google Pay provisioning token, anaa Microsoft 365 session cookie wɔ sikɔne kakraa bi mu. Saa akwankyerɛ yi kyerɛkyerɛ anammɔn a ɛsɛ sɛ woyɛ ntɛm ara de siw ano wɔ simma kakraa bi mu bere a woahwehwɛ QR koodu a enye no mu kɔ akyiri, a egyina nea esii wɔ wo screen so no so.

--- .

Yɛ eyi mprempren¶

1. Hyɛ nea woyɛe ntɛm ara BERE a woayɛ QR code no scan. Sɛ wubue wɛbsaet krataafa a ɛyɛ pɛpɛɛpɛ wɔ Apple Safari anaa Google Chrome mu wɔ iPhone anaa Android fon a ɛyɛ foforo so kɛkɛ a, ɛntaa mma sɛ wode malware a ɛkɔ so daa no ankasa nhyɛ mu. Nanso, sɛ wo kyerɛw credit card nɔma, wohyɛɛ email/Microsoft 365/Google password ne 2FA code, woahwehwɛ QR code no fi app a woakɔ mu mu (te sɛ Discord, WhatsApp, anaa Microsoft Authenticator), anaasɛ wode a .apk app anaa .mobileconfig profile, ɛsɛ sɛ woyɛ targeted containment mprempren ara.
2. Sɛ wo typew wo credit card anaa debit card wɔ atoro parking meter, toll road, anaa EV charger website mu a, frɛ nɔma a ɛwɔ wo card akyi no ntɛm ara na twa card no mu NA bisa agent no sɛ "Revoke all Digital Wallet VTS/MDES Network Tokens." Fake parking and parcel fee pages no nnye dɔla 3 kɛkɛ wɔ wo kar a wode besi hɔ ho wɔyɛ akyi script a ɛde wo kaad kyerɛw to ɔtowhyɛfo bi Apple Pay, Google Pay, anaa Samsung Pay smartphone sika kotoku mu denam SMS pɛnkoro passcode a wokyerɛw wɔ krataafa a wode gye sika no so no so. Sɛ wosrɛ wo sikakorabea no plastic kaad a wode besi ananmu nkutoo a woantwa Visa Token Service (VTS) anaa Mastercard Digital Enablement Service (MDES) dijitaal sika kotoku token ahorow no mu a, ɔtowhyɛfo no fon sika kotoku no begye wo kaad nɔma foforo no ara kwa na akɔ so agye wo akontaabu no ho ka.
3. Sɛ wokɔ Microsoft 365, Google Workspace, anaa sikakorabea login krataafa bi mu bere a woahwɛ QR code akyi a, fa kɔmputa a ɛho tew sesa wo password NA klik "Sign out of all sessions / Revoke OAuth tokens" ntɛm ara. Corporate quishing emails route through Evilginx / Modlishka Adversary-in-the-Middle (AiTM) reverse proxies a ɛwia wo post-authentication session cookie mpo bere a wode authenticator app redi dwuma no. Di yɛn akyi MFA phishing ne Ɔtamfo-wɔ-Mfinimfini no bypass kyerɛ wo adwumakuw IT Security / SOC kuw no kwan na bɔ kɔkɔ wɔ simma anum ntam.
4. Sɛ wode camera scanner a ɛwɔ mu no scan QR code bi wɔ WhatsApp, Discord, Telegram, Steam, anaa WeChat MU a, bue saa app no "Linked Devices" menu no na fi nhyiam ahorow a wunnim nyinaa mu ntɛm ara. Sɛ wo scan ɔtowhyɛfo bi "QR Login" code fi nkrasɛm anaa agodie app a wɔagye atom mu a, ɛma ɔtowhyɛfo no nya ntɛm ara WebSocket session clone wɔ wo akontaabu mu a enhia wo password anaa 2FA code.
5. Sɛ QR code no ka kyerɛɛ wo sɛ twe Android bi a .apk fael anaa fa iOS Nsiesiei Profile (.mobileconfig), fa wo fon no to Airplane Mode mu na yi profile anaa app no ntɛm ara. Hwɛ Settings > General > VPN & Device Management wɔ iOS anaa Settings > Security > Ahobanbɔ nhyehyɛe pii > Device admin apps wɔ Android so, na fa yɛn stalkerware, spyware, ne keylogger a wohu wɔ telefon so akwankyerɛfo.
6. Sɛ wuhuu QR sticker a ɛnyɛ nokware wɔ kurow no mu mita a wɔde kar sisi, transit kiosk, anaa EV charger so a, nhyia obiara a ɔrekyinkyin wɔ baabi a ɛbɛn hɔ. Tu kɔ baabi a ahobammɔ wɔ, bɔ nea ɔhwɛ baabi a wɔde kar sisi anaa kurow no mu mmarahyɛ bagua no nɔma a wɔatintim wɔ kiosk no dade nipadua a wɔayɛ ho adwini so no amanneɛ, na sɛ wuhyia honam fam ahunahuna biara a, frɛ wo mpɔtam hɔ nɔma a egye ntɛmpɛ (911 wɔ United States ne Canada, 112 wɔ Europa Aman Nkabom no nyinaa mu, 999 wɔ United Kingdom, anaa hwɛ yɛn nɔma ahorow a egye ntɛmpɛ nkyerɛwde a wɔde kyerɛw nsɛm).

--- .

QR code a ɛyɛ bɔne (Quishing) asɛm a esii triage gyinaesi dua¶

flowchart TD
    Root["Scanned QR Code a ɛyɛ adwenem naayɛ anaa nea ɛyɛ hu ara kwa"] --> ActionTaken{"Dɛn na Ɛbaa Bere a Wo Scan QR Code no Awiei?"}

    ActionTaken -->|"1. Wɛbsaet Kratafa a Wɔabue Nkutoo: Tab a Wɔato mu a Wonkyerɛw Biribiara anaasɛ Wontwe"| SafeClean["Asiane a ɛba fam: To browser tab mu -> Popa site data/cookies ma saa domain no -> Hwɛ Downloads folda -> Hwɛ sɛ iOS/Android OS yɛ foforo"]

    ActionTaken -->|"2. Wode Credit/Debit Card ahyɛ Fake Parking Meter, EV Charger, anaa Parcel Page so"| CardComp["1. Frɛ Bank Fraud Dept ntɛm ara na lock & replace card<br/>2. AHOROW: Hwehwɛ sɛ wotwa Apple Pay / Google Pay Digital Wallet Tokens (VTS/MDES) nyinaa mu<br/>3. Hwɛ sɛ ebia wontua wo kar no ka ankasa wɔ mita no so na amma wɔantwe wo"]

    ActionTaken -->|"3. Adwuma/Email Asɛmfua a Wɔde Hyehyɛ Mu + 2FA Kood (Microsoft 365, Google, Okta) ."| CredComp["1. Fa no sɛ AiTM Nhyiam Kuki Korɔn (Evilginx)<br/>2. Wɔ PC a ɛho tew so no, sesa password & klik 'Sign Out of All Sessions'<br/>3. Popa MFA mfiri a ɛyɛ atoro & inbox forwarding mmara<br/>4. Bɔ Corporate IT SOC kɔkɔ ntɛm ara"]

    ActionTaken -->|"4. QR Code a Wɔayɛ Scan denam In-App Scanner (WhatsApp, Discord, Telegram, Steam) a Wɔde Di Dwuma So ."| SocketHijack["Bue App Nsiesiei -> 'Linked Devices' / 'Authorized Devices' -> Ntɛm ara twa Web/Desktop Nhyiam a Wonnim Nyinaa"]

    ActionTaken -->|"5. Wode App (.apk), iOS Nsiesiei Profile, anaa Klik ‘Ma kwan’ wɔ Prompts so"| MalwareCheck["1. Dane Airplane Mode no ntɛm ara<br/>2. iOS: Nsiesiei > General > VPN & Device Management -> Popa profile a wonnim<br/>3. Android: Yi APK a ɛyɛ atoro no fi hɔ & twa Accessibility/Admin tumi krataa no mu"]

--- .

Mfiridwuma ntua vectors soronko 5 a ɛwɔ QR codes akyi no ntease¶

Ɛnyɛ sɛ QR code (ISO/IEC 18004 gyinapɛn) bue nko https:// wɛbsaet ahorow so. Ɛgyina URI nhyehyɛe a wɔde ahyɛ module tuntum ne fitaa no mu so no, sɛ wo scan code bi a, ebetumi akanyan nneyɛe ahorow anum a ɛsono emu biara koraa wɔ wo smartphone so:

--- .

Tebea A: Wohwɛɛ QR sticker a ɛnyɛ nokware wɔ mita a wɔde si kar, EV charger, anaa toll notice so na wokyerɛw sikatua ho nsɛm¶

QR a wɔde kata so honam fam nsakrae akɔ soro wɔ nkurow akɛse a ɛwɔ Amerika Atifi fam, Europa, United Kingdom, ne Australia mu. Esiane sɛ wɔn a wɔayɛ wɔn basabasa no taa gyina kwan a adagyew nnim so de ahopere nti, wɔntaa nhu sɛ wɔde vinyl sticker a ɛhyerɛn abɔ dade mita anim a wɔayɛ ho adwini no so.

Sikasɛm ne kar a wɔde siw ano anammɔn biara¶

1. Tow kaad a wɔasɛe no no mu na popa Digital Wallet Provisioning Tokens (VTS / . MDES):
2. Bue wo banking mobile app ntɛm ara na toggle Lock / Freeze Card kɔ ON.
3. Frɛ nsisi nɔma a ɛwɔ wo kaad akyi no na bisa Digital Wallet / Tokenization Fraud Desk no.
4. Nea enti a standard card replacement di nkogu: Sɛ wo kyerɛw SMS code anaa email code a ɛwɔ digit 6 wɔ fake parking page no so bere a woakyerɛw wo card nɔma awie no a, woahyɛ da ama ɔtowhyɛfo no tumi sɛ ɔmfa wo card no nkɔ wɔn Apple Pay, Google Pay, Garmin Pay, anaa Fitbit Pay akontaabu no so. Bisa sikakorabea ananmusifo no sɛ:
   1. Hwɛ Active Digital Wallet / Device Tokens a ɛbata wo Primary Account Number (PAN) ho nyinaa.
   2. Popa/Twa Apple Pay, Google Pay, ne aguadifo token ahorow a wonnim nyinaa.
   3. Yi Visa Account Updater (VAU) / Mastercard Automatic Billing Updater (ABU) mu ma saa san a wɔde ma yi sɛnea ɛbɛyɛ a wɔremfa kaad nɔma foforo no nkɔma nsisifo a wɔsan ba bio no ara kwa.
5. Tua wo parking session no ho ka wɔ mmara kwan so mprempren ara sɛnea ɛbɛyɛ a wo kar no rennya tekiti, boot, anaasɛ wɔrentwe:
6. Kae: Esiane sɛ na QR sticker no yɛ nsɛmmɔnedifo dea na ɛnyɛ kurow no mu adwumayɛbea a ɛhwɛ kar so nti, mprempren wɔde wo kar krataa no asi hɔ a wontuaa ho ka.
7. Mfa scan sticker biara a ɛwɔ afiri no so da. Mmom, nantew kɔ mita no so na fa honam fam sika/tap a wonni nkitahodi tua tẽẽ wɔ hardware terminal no so, anaa kɔ Apple App Store / Google Play Store a ɛyɛ aban de no so, twe municipal app a wɔagye atom (te sɛ ParkMobile, PayByPhone, RingGo, EasyPark, anaa PayStay), na kyerɛw 4-to-6-digit Zone Number painted on the dade dua.
8. Twa atoro sticker no mfonini ansa na woabɔ ho amanneɛ:
9. Twa mfonini a emu da hɔ a ɛkyerɛ mita a wɔde si kar anaa EV charger a ɛkyerɛ QR sticker a ɛnyɛ nokware (hwehwɛ adhesive anoano a ɛkɔ soro, font akɛse a ɛnhyia, anaa sticker a ɛkata aban ahyɛnsode no fã bi so) ne mita serial/pole number no nyinaa.
10. Frɛ municipal parking authority anaa EV charging network (ChargePoint, Electrify America, EVgo, Ionity, Shell Recharge) atɔfoɔ som telefon nɔma a wɔatintim wɔ kiosk no so sɛdeɛ ɛbɛyɛ a adwumayɛfoɔ a wɔhwɛ so no bɛtumi aprapra sticker a wɔde akata so wɔ abɔnten so block no nyinaa so.

--- .

Nsɛm a ɛfa ho B: Wo scan QR code bi wɔ adwuma email anaa PDF mu na wohyɛɛ wo Microsoft 365, Google, anaa Okta login mu¶

Wɔ nnwumakuw kɔmputa so ahobammɔ mu no, QR code phishing ne #1 delivery adwinnade ma Adversary-in-the-Middle (AiTM) session hijacking. Esiane sɛ adwumayɛfo dodow no ara kenkan adwuma email wɔ wɔn desktop monitor so na wɔfa wɔn ankorankoro smartphone de scan QR code a ɛwɔ screen no so nti, login no kɔ so wɔ odwumayɛni no cellular 5G connection so, na ɛtwam adwumakuw laptop no Endpoint Detection and Response (EDR) agent, adwumakuw firewall, ne browser phishing ntrɛwmu no ho hyia koraa.

Ntɛm ara simma 15 akontaabu a wɔde siw ano protocol¶

1. MMFA no sɛ wo Authenticator App no abɔ wo ho ban:
2. Nnɛyi quishing nkratafa de Evilginx, Modlishka, anaa Muraena reverse proxyes di dwuma. Sɛ wokyerɛw wo adwumakuw email, password, ne 6-digit Authenticator code (anaasɛ wopene Authenticator Push / nɔma match so) wɔ fake mobile krataafa no so a, attacker no server no de wo credentials kɔ login.microsoftonline.com wɔ bere ankasa mu na ɛkyere nea efi mu ba no ** .ESTSAUTH / . ESTSAUTHPERSISTENT nhyiamu kuki**.
3. Wɔ kɔmputa a ɛho tew so no, dannan wo password NA twa active session tokens nyinaa mu:
4. Microsoft 365 / Entra ID: Kɔ ** .https://mysignins.microsoft.com/security-info** na ɛyɛ. Nea edi kan no, klik Sign out everywhere (sɛ wobɛma session cookie a woawia no ayɛ nea enni mu). Nea ɛto so abien no, sesa wo password. Nea ɛtɔ so mmiɛnsa, hwɛ Sign-in akwan a wɔahyehyɛ no yie wɔ saa kratafa pɔtee no so, attackers de automated scripts di dwuma a ɛkyerɛw wɔn ankasa rogue Authenticator App anaa FIDO2 key wɔ wo account so wɔ sikɔne 8 mu wɔ sikɔne 8 akyi a wɔwiaa wo cookie no. Popa Authenticator mfiri biara a wunnim.
5. Google Adwumayɛbea / Gmail: Kɔ https://myaccount.google.com/device-activity, klik mobile/Linux session a wonnim no so -> Sign out, sesa wo password, na hwɛ sɛ 2-Step Verification mfiri ahorow no yɛ nokware.
6. Hwɛ wo email inbox no mu sɛ "Mmara / Forwarding" kɔ so yɛ komm:
7. Ntuafo a wɔfa QR code so kyere adwumakuw bi nkrataa adaka no yɛ Inbox Mmara a ahintaw ntɛm ara wɔ Outlook Web (Settings > Mail > Rules na Forwarding) a ɛde email biara a ɛba a nsɛmfua te sɛ "Invoice", . "Wire", . "Payment", . "ACH", anaa "DocuSign" kɔ RSS Subscriptions anaa Archive folda no mu bere a worehyɛ no agyirae sɛ wɔakenkan no. Audit na popa mmara a wonnim nyinaa denam yɛn email account hacked, forwarding mmara, ne sanba akwankyerɛfo.
8. Bɔ wo adwumakuw IT Help Desk anaa Security Operations Center (SOC) amanneɛ ntɛm ara:
9. Mfa QR scan a ɛbae wɔ akwanhyia mu nsie da esiane aniwu nti. Sɛ wofrɛ IT wɔ simma 5 mu a, ɛma ɔhwɛfo bi tumi klik "Revoke sessions" ne "Require re-register MFA" wɔ Entra ID / Okta mu ansa na ɔtowhyɛfo no atumi afi ase a Adwumayɛ Email Nsiesiei (BEC) waya nsisi ntua a wɔde ba w’afɛfo so.

--- .

Nsɛm tebea C: Wode In-App Scanner (WhatsApp, Discord, Telegram, Steam) na ɛhwɛɛ QR koodu bi .¶

Sɛ w'adamfo bi, agodie server "Verification Bot," anaa atoro giveaway krataafa ka kyerɛ wo sɛ "Bue Discord / WhatsApp / Steam -> Bue QR Scanner -> Scan saa code yi na woagye akatua anaasɛ woahwɛ sɛ wo mfe a woadi" a, woankɔ wɛbsaet bi so, woama Remote Desktop / Web Client Login (QRLJacking):

• WhatsApp: Bue WhatsApp ntɛm ara wɔ wo fon so -> tap Settings (anaasɛ nsensanee abiɛsa no ⋮ wɔ Android so) -> tap Linked Devices -> tap biara a wɔakyerɛw Google Chrome (Windows/Linux/Mac) anaasɛ nhyiamu a wonnim -> pia Log Out.
• Discord: Bue Discord ntɛm ara -> pia Settings -> Devices -> Log Out All Known Devices, na sesa wo Discord password (sɛ wosakra wo Discord password a, ɛno ara ma nea wowiae no yɛ nea enni mu Authorization token wɔ ɔtowhyɛfo no browser mu).
• Telegram: Bue Telegram -> Nsiesiei > Mfiri -> Twa Nhyiam Afoforo Nyinaa.
• Steam: Bue Steam Mobile App no -> pia Shield ahyɛnsode (Steam Guard) -> Gear ahyɛnsode -> Authorized Devices -> Yi kwan fi PC biara a wunnim so.

--- .

Scenario D: Wo scan QR code no nko ara na wubuee wɛbsaet krataafa no (Wankyerɛw biribiara) .¶

Sɛ wode wo iPhone anaa Android mfoninitwa afiri no kyerɛ QR koodu a ɛyɛ adwenem naayɛ so, wobɔ URL frankaa kɔkɔɔ no so, wuhu sɛ wɛbsaet krataafa bi a ɛyɛ sketchy load wɔ Safari anaa Chrome mu, na ntɛm ara na woato mu a woankyerɛw password biara, credit card, anaasɛ woakliki "Install" a:

1. Gye ahome: Browser a wɔde kar kyere a wɔmfa kar nkɔ baabiara a wɔde di dwuma fi abɔnten so kar sticker sticker so no yɛ nea ɛntaa nsi. Mobile browser a wɔde di dwuma wɔ aguadi mu a wɔmfa kar sisi no gye dɔla ɔpepem pii na ɔman no amansɛmdi adwumayɛbea ahorow de asie ama akwansrafo a wɔde wɔn ani asi so, na ɛnyɛ nsisi a wɔyɛ wɔ mita a wɔde kar sisi mu a nnipa pii yɛ.
2. To browser tab no mu na tew site storage no ho:
3. iOS (Safari): To tab no mu, afei bue Settings > Apps > Safari > Advanced > Website Data, hwehwɛ domain din a ɛyɛ hu no, na twe kɔ benkum kɔ Popa ne cookies ne cache.
4. Android (Chrome): Klik padlock / tune icon a ɛwɔ address bar no benkum so -> Cookies ne site data -> Delete (anaasɛ kɔ Settings > Privacy and security > Delete browsing data -> Last hour).
5. Hwɛ sɛ wo browser no antumi anhyɛ push notification spam mu komm anaasɛ antwe fael bi:
6. Wɔ Android Chrome mu no, kɔ Settings > Site settings > Notifications na hwɛ sɛ wɔamma wɛbsaet biara a ɛyɛ nwonwa kwan sɛ wɔmfa atoro "Virus Detected" push notification pop-ups nkɔma wo.
7. Bue Files / Downloads folda no wɔ wo fon so na popa biara .apk, . .pdf, . .ics (kalenda so spam), anaa .mobileconfig fael a ɛtwee ne ho bere a kratafa no load no.
8. Hwɛ sɛ wɔanhyɛ GSM Call Forwarding biara ase (sɛ QR code no buee wo Phone Dialer no a):
9. Bue wo fon keypad na frɛ ** .*#21#** (hwɛ frɛ a wɔde kɔ anim tebea a enni nnyinaso). Sɛ wɔakyerɛw nɔma biara a, frɛ ** .##002#** na mia Call so na popa GSM call-forwarding mmara nyinaa wɔ wo carrier line no so.

--- .

Nsɛm tebea E: Atoro Cryptocurrency Hardware Wallet QR Codes ne Atoro "AirDrop / Claim" Stickers¶

Quishing vector foforo a ɛrenya nkɔso ntɛmntɛm no de n’ani si cryptocurrency wuranom so denam honam fam nkrataa a wɔde mena ne nneɛma a wɔde kyekyere nneɛma a wɔayɛ no foforo so:

1. Tampered Ledger / Trezor / Coldcard Nneɛma a Wɔde Hyehyɛ Nneɛma Mu:
2. Nsisifo tɔ hardware sika kotoku, de atoro akwankyerɛ krataa a wɔayɛ no laminated a QR code a ɛkenkan "Scan to run mandatory Firmware Integrity Check or initialize your 24-word recovery seed" hyɛ mu, shrink-wrap adaka no, na wɔde san kɔ third-party retail marketplaces.
3. Golden Rule: Hardware sika kotoku a ɛfata da nsrɛ wo sɛ kyerɛw wo nsɛmfua 12 anaa nsɛmfua 24 BIP-39 recovery phrase no nkɔ smartphone wɛb krataafa so anaasɛ scan QR code a ɛbisa wo aba nsɛmfua. Sɛ wode wo aba kasasin no hyɛɛ mu bere a woahwɛ QR code bi akyi a, sweeper bot a ɛyɛ adwuma ankasa ahwɛ wo sika kotoku no so dedaw; kum yɛn cryptocurrency sika kotoku drain ne aba kasasin apam protocol ntɛm ara.
4. WalletNkitahodi (wc:) DApp Drainer a ɛyɛ hu QR Codes:
5. Scanning a wc: QR koodu a efi MetaMask, Phantom, Rabby, anaa Trust Wallet mu no de wo Web3 sika kotoku no bata nnipa foforo decentralized application (DApp) ho. Sɛ wɛbsaet no pue ntɛm ara a, wɔde nsaano nkyerɛwee adesrɛ (Permit2, . setApprovalForAll, anaa increaseAllowance), klik Pow na twa WalletConnect nhyiamu no mu wɔ Nsiesiei > Nkitahodibea ahorow / WalletConnect Nhyiamu ase.

--- .

Forensics: Sɛnea wobɛtumi akyerɛkyerɛ QR code mfonini a ɛyɛ adwenem naayɛ mu na woahwɛ mu dwoodwoo a womfa wo fon nhwehwɛ mu¶

Sɛ wo nsa kaa PDF anaa email a ɛyɛ adwenem naayɛ a QR code wom na wopɛ sɛ wuhu baabi a ɛkɔ a womfa wo smartphone nka ho a, fa akwan a ahobammɔ wom yi di dwuma wɔ command-line anaa sandboxed akwan so wɔ desktop kɔmputa so:

# 1. Decode the raw text/URL inside a QR code image offline using 'zbarimg' (Linux/macOS):
# (Does NOT connect to the internet; simply prints the decoded string to your terminal)
zbarimg --raw suspicious_qr_image.png

# 2. Trace all HTTP 301/302 redirect hops without executing JavaScript or loading the page:
curl -sIL --max-redirs 10 "https://suspicious-short-url.example/xyz" | grep -iE "^(HTTP/|location:)"

# 3. Inspect DNS registration age (Quishing domains are almost always <14 days old):
whois suspicious-parking-domain.com | grep -iE "Creation Date|Registrar:"

Honam fam ne dijitaal Quishing ntua ho amanneɛbɔ a wɔde bɛma aban mpanyimfo¶

Sɛ wɔbɔ QR code a ɛyɛ hu ho amanneɛ a, ɛma kurow no mu adwumayɛfo yi honam fam sticker no ne phishing domain a ɛwɔ ase no nyinaa sinkholed denam wiase nyinaa browser blocklists (Google Safe Browsing ne Microsoft SmartScreen) so:

1. Bɔ URL bɔne no ho amanneɛ kɔ Google Safe Browsing & Cloudflare Radar: Fa URL a wɔakyerɛ ase no kɔ safebrowsing.google.com/safebrowsing/report_phish/ na radar.cloudflare.com/scan. Sɛ wɔde frankaa hyɛ no wie a, iPhone Safari ne Android Chrome browser biara a ɛwɔ wiase nyinaa bɛda kɔkɔbɔ kɔkɔɔ a ɛwɔ screen mũ nyinaa adi "Deceptive Site Ahead" wɔ simma 15 kosi 30 mu bere biara a ɔnam famfo a odi hɔ no bɛhwehwɛ saa mita a wɔde si kar so sticker no.
2. Fa kɔmputa so nsɛmmɔnedi ho amanneɛbɔ a ɛyɛ aban de ma:
3. United States: Fa amanneɛbɔ kɔma FBI Intanɛt so Nsɛmmɔnedi Ho Anwiinwii Asoɛe (ic3.gov) ne Aman Nkabom Aguadi Bagua (reportfraud.ftc.gov), na bɔ wo mpɔtam hɔ kurow no mu adwumayɛbea a ɛhwɛ kar so no amanneɛ.
4. United Kingdom: Fa quishing emails kɔ report@phishing.gov.uk (Ɔman Cyber Security Centre) na bɔ sikasɛm mu adehwere ho amanneɛ kyerɛ Action Fraud (actionfraud.police.uk) na ɛyɛ.
5. Europa Aman Nkabom, Canada, ne Australia: Amanneɛbɔ a wɔde kɔma Canada Asoɛe a Ɛko Tia Nsisi (antifraudcentre-centreantifraude.ca), Australiafo Nsisi Nnwom (scamwatch.gov.au), anaa wo ɔman kɔmputa so ntɛmpɛ ho kuw (CERT).

--- .

Sɛnea wobɛhwehwɛ QR code biara mu dwoodwoo ANSA na woakɔ URL no so (Prevention Checklist) .¶

Ɛho nhia sɛ wususuw baabi a QR code bi de wo ho da. Di mmara anum yi akyi bere biara a wubehyia QR code wɔ baguam anaasɛ wode mena:

• Fa wo nsateaa nnadewa tu mmirika fa honam fam QR koodu so wɔ mita a wɔde si kar, EV charger, ne adidibea pon so: Wɔde kar sisi kiosk ne EV charger QR code a ɛfata no yɛ wɔde silk screen ayɛ no tẽẽ wɔ dade faceplate no so anaasɛ wɔatoto mu wɔ polycarbonate ahobammɔ krataa a emu da hɔ no ase. Sɛ wo nsateaa nnadewa kyere krataa anaa vinyl sticker a ɛbata sɛnkyerɛnne no atifi no ano a wɔama so a, nhwehwɛ no da.
• Kenkan URL preview mũ no nyinaa wɔ wo kurom camera app no ​​mu na bu w’ani gu URL shorteners so: iOS Camera app a wɔde ahyɛ mu ne Android Camera no nyinaa da pill banner ketewa bi a ɛkyerɛ domain din no adi ansa na woabue browser no. Sɛ municipal parking meter anaa sikakorabea amanneɛbɔ kyerɛ URL a wɔatwa no tiaa anaasɛ ɛyɛ generic (bit.ly, . tinyurl.com, . qrco.de, . t.co, . lnkd.in, anaa page.link), nbɔ so, aban adwumayɛbea ne sikakorabea akɛse mfa third-party link shorteners nni dwuma da wɔ payment kiosks so.
• DUM "Open Links Automatically" wɔ wo fon camera nhyehyɛe mu: Hwɛ sɛ wo camera app no ​​hwehwɛ sɛ wo kenkan na wobɔ URL preview banner no sen sɛ wobɛbue browser no ntɛm ara a QR code bi bɛhyɛn frame no mu.
• Mfa scan QR code a ɛba honam fam krataa anaa postcard a wɔammisa mu da ("USPS / Royal Mail / Amazon Mystery Package"): Nsisifo de honam fam nneɛma a wɔde mena a ade a ne bo nyɛ den a wɔankra (te sɛ plastic ring anaa telefon charger, "Brushing Scam") a kaad a ɛkenkan "Scan QR code yi na hwɛ onii a ɔde akyɛde yi kɔmaa wo anaasɛ di wo sanba ho dwuma." Tow QR no kaad a ɛwɔ nwura mu.
• Twe parking ne EV charging apps tẽẽ fi App Store / Play Store: Sɛ anka wobɛ scan abɔnten QR code no, bue official ParkMobile, PayByPhone, RingGo, anaa ChargePoint app no ​​na kyerɛw Zone Number a wɔatintim wɔ sɛnkyerɛnne no so.

--- .

Nsɛm a wɔtaa bisa¶