Watch Out for This ‘Quishing’ Attempt Tied to 2026 Registration
This email below has been confirmed as malicious or fraudulent by the Information Security department. If you have received this phishing email, do not open any attachments or follow the link(s) in the message; simply delete the email.The following email, disguised as a business two-factor authentication notice, exhibits several characteristic indicators of a phishing attempt commonly referred to as “quishing” (QR code phishing):
Red Flags:
1. Impersonal greeting: The message opens with a vague “Hello” rather than addressing the recipient by name. This is unusual for real account-specific security notice.
2. False sense of obligation: Language like “You’re hereby required to confirm” mimics official, legal sounding phrasing to pressure quick compliance without questioning the request.
3. Exploits a timely, believable event: By referencing “the new academic session,” the email ties itself to a real, expected occurrence, making the request feel routine and legitimate.
4. Use of a QR code instead of a text link: This is a major red flag. QR codes are harder to inspect before scanning, often evade email security filters designed for malicious URLs, and take you outside of the protection of your organization’s network once scanned.
5. Vague call to action: “Complete the exercise” is unusually generic phrasing for something as sensitive as two-factor authentication. Legitimate IT communications are typically specific and direct you to a known portal.
6. Borrows credibility from a trusted tool: By referencing Duo, the email leverages the recipient’s existing trust in that platform to lower their guard.
What to do: If you receive this email, do not scan the QR code. Click the “Phish Alert Report” button in your email.
