Bartosz Michalski - Quishing vs. User: The chase for the "un"scanned QR code

### Overview Bartosz Michalski, an analyst leading operations at the Cyber Security Operations Center (SOC) at Bank Pekao S.A. (with over 10,000 users), discusses quishing (QR code phishing) and analyzes the psychological and human dynamics involved in incident triage. Through a real-world case study of an employee who scanned a fraudulent QR code while working remotely, the presentation demonstrates why SOC teams must move away from penalizing users and instead cultivate psychological safety, direct communication, and comprehensive security awareness.

### Key Topics - **Prevalence of Quishing**: Attackers increasingly deploy QR codes across physical locations (parking meters, charging stations, medical clinic bulletin boards) and digital channels (PDF email attachments pretending to come from brands like Microsoft, DHL, or DocuSign) to harvest credentials or infect systems. - **The "Unscanned" QR Code Incident**: An incident investigation where SOC telemetry initially showed no trace of compromise, only for direct human communication to uncover that the user had scanned the QR code using a personal mobile device while working from home. - **Human Emotion and Fear in Incident Reporting**: The fear of disciplinary action or job loss, especially among new or probationary staff, creates an urge to conceal mistakes or lie to security analysts, blinding defensive visibility. - **The CyberPKO Education Program**: Development of proactive outreach initiatives to educate internal employees, corporate/retail clients, seniors, and younger generations.

### Technical Details - **Email Security Limitations**: In the analyzed case, an employee received an inbound email containing a PDF titled "payment". Sender authentication mechanisms—SPF, DKIM, and DMARC—passed without issue, and the message did not trigger mass-mailing heuristics. - **SOC Analysis Workflow**: An analyst manually identified the suspicious message, tested the URL and extracted QR code within a sandbox via a VNC session, and determined it redirected to a phishing landing page spoofing Microsoft credential authentication. - **Mitigation & Telemetry Blind Spots**: The SOC blocked both the initial redirect URL and the final landing domain on proxy/Web Security Gateway systems, and blocked the sender address. Telemetry across corporate laptops and mobile devices showed zero visits to the malicious URLs. - **Root Cause & Workarounds**: Investigation into SIEM and internal systems confirmed the user was working remotely. Direct phone outreach revealed the employee had scanned the code using a personal smartphone on their desk, bypassing corporate endpoint visibility. The user ultimately did not input credentials due to suspicion and familiarity with conditional access policies.

### Takeaways - **Treat QR Codes as Untrusted Links**: Organizations and users must treat QR codes with the same skepticism as unsolicited links, validating source legitimacy before scanning. - **Avoid Stigmatizing Mistakes**: Security teams must adopt a calm, supportive approach when speaking with users. Establishing trust and reassuring users that their honesty protects the entire organization prevents employees from lying about security lapses. - **Visible, Accessible SOC Outreach**: Clear reporting pathways (Outlook reporting buttons, ticketing systems, direct hotlines) combined with regular awareness sessions produce higher volumes of reporting and faster incident mitigation.