Microsoft has issued a new warning over the rise in QR code phishing scams, where hackers are targeting users through fake emails and fraudulent login pages to steal login credentials and sensitive data.
According to Microsoft cybersecurity experts, attackers are using professionally designed fake emails and PDF files to redirect users to counterfeit login pages through QR codes. The scams are being used to obtain passwords, account access credentials, and other sensitive information.
Microsoft said cybercriminals are sending QR codes through emails that direct users to fraudulent websites. The emails are designed to resemble official communications from HR departments, IT support teams, or company management.
The emails typically cite issues such as account suspension, security updates, or mandatory compliance requirements to pressure users into taking immediate action. Once a user scans the QR code, they are redirected to a fake login page where their login details can be stolen.
Microsoft security researchers said more than 35,000 users across 13,000 companies have been targeted through such scams. Attackers are attempting to obtain not only passwords but also session tokens and other sensitive information.
The company said some cases have raised concerns that accounts could be accessed even when two-step verification is enabled. Cybersecurity experts said the scams are spreading rapidly because QR codes are generally perceived as safe, leading many users to scan them without verification.
Cybersecurity experts advised users not to scan QR codes received through unknown emails or messages. Users have also been advised to verify the identity of the sender before accessing any login page or link and remain cautious of emails designed to create urgency or fear.
Experts further recommended keeping phones and systems regularly updated and enabling two-factor authentication across all critical accounts.
In cases where a suspicious QR code has already been scanned, users have been advised to immediately disconnect from the internet, change passwords, and review account activity. Experts said performing a factory reset of the affected device could also be considered as a precautionary measure.
