
- North Korean group Kimsuky is using QR code phishing to steal credentials
- Attacks bypass MFA via session token theft, exploiting unmanaged mobile devices outside EDR protections
- FBI urges multi-layered defense: employee training, QR reporting protocols, and mobile device management
North Koreans are targeting US government institutions, think tanks, and academia with highly sophisticated QR code phishing, or 'quishing' attacks, going for their Microsoft 365, Okta, or VPN credentials.