Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Phishing on the Edge of the Web and Mobile Using QR Codes

Summary: Unit 42's telemetry shows an average of over 11,000 detections of malicious QR codes each day, drawn from offline web crawlers that find about 75,000 QR code detections daily, with 15% of those pages containing QR codes leading to malicious links. Attackers use QR code shorteners, in-app deep links and direct downloads to bypass awareness and security controls, and the researchers found over 35,000 QR codes containing Telegram in-app deep links such as tg://login or tg://resolve, with login accounting for 97% of the Telegram deep links observed.

Bottom line: QR code shortener traffic rose 55% from the first half of 2023 to the first half of 2024 and another 44% into the first half of 2025, and financial services accounted for 29% of attacks involving compromised QR code shorteners despite making up only 4.8% of that traffic overall. Standard web crawlers cannot see the activity these in-app deep links generate, so detection requires a mobile sandbox with the specific app installed.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026