The QR code that steals your session, not your password

The origin

Kimsuky has worked for North Korea since 2012, and its trade has never really changed: find out what the West thinks about North Korea. It doesn't steal patents or encrypt drives. It reads the mail of the people who write the papers that land on ministers' desks.

On 8 January 2026 the FBI published FLASH AC-000001-MW, its only advisory dedicated to the group this year, describing incidents from May and June 2025. The document doesn't hedge: it names "North Korean state-sponsored cyber threat group Kimsuky" outright — though it's worth noting it attaches no explicit confidence percentage. Kaspersky corroborated broader activity on 14 May 2026, working from samples collected between August 2025 and February 2026.

The targets have been consistent for a decade: think tanks, NGOs, academics, foreign-policy experts on North Korea, government bodies. The FLASH names the primary target explicitly: the United States.

1. 2012
   The start

   Kimsuky has worked for North Korea since then.

2. May-June 2025
   The incidents

   The episodes the FLASH describes.

3. 8 January 2026
   The FBI FLASH

   AC-000001-MW, its only advisory on the group this year.

4. 14 May 2026
   The corroboration

   Kaspersky documents broader activity, from samples collected August 2025-February 2026.

What's new isn't who they hit. It's how.

The attack chain

There's no CVE in this story. No exploit. There's an image.

The spearphishing email impersonates a Korea-policy advisor, an embassy staffer, a conference organiser. Inside it, a QR code.

What follows is the part that makes this hard to stop, and it's worth sitting with:

1. The victim scans the QR with their personal phone
2. A redirector fingerprints the device — user agent, OS, IP, language, screen resolution
3. A mobile-optimised credential harvesting page appears, impersonating Microsoft 365, Okta, a corporate VPN, or Google
4. The user enters their credentials
5. The attacker steals and replays the session token
6. MFA is bypassed without generating any "MFA failed" alert
7. Persistence in the account, then lateral phishing to contacts — this time from a genuine sender

Why the channel matters more than the content

A company can run the best email gateway money buys. Attachment sandboxing, URL rewriting, link detonation, machine learning on message text. That entire fortress defends the corporate laptop.

But a QR code isn't clicked — it's scanned. And it's scanned with the phone in your pocket: a device that is almost never inside the IT perimeter, doesn't route through the corporate proxy, never touches the gateway, has no EDR.

Kimsuky didn't defeat email security. It changed the input channel, and the rest of the chain plays out somewhere corporate defence simply isn't looking. This is social engineering that sidesteps ten years of investment by moving the problem four inches.

Detection

Here's the most valuable operational detail in the FLASH, and it inverts a common assumption.

Most SOCs build detection on failure: failed MFA prompts, repeated bad passwords, denied logins. That's reasonable logic — an attacker forcing their way in makes mistakes, and mistakes are visible.

Session token theft never makes a mistake. The attacker doesn't attempt MFA; they walk past it holding a token that has already been validated. In the logs, the result is a successful first-try login by a legitimate user with a valid session. There is no negative event to correlate on.

So what to work with:

• The absence of "MFA failed" alerts despite a bypass having occurred — a behavioural indicator, not a static one. If you have evidence of anomalous access with no upstream MFA failures, token replay is your leading hypothesis
• Credential entry immediately following a mobile QR scan
• Suspicious forwarding rules or filters created on compromised mailboxes — the signal that step 8 has already begun

Remediation

From the FBI FLASH, ordered by actual effectiveness against this chain:

The one that closes the problem:

• Mandatory phishing-resistant MFA. Not "MFA". Phishing-resistant — FIDO2, passkeys, certificates. An SMS or app OTP is replayed without difficulty by an AitM proxy; a passkey is cryptographically bound to the origin and won't replay against a lookalike domain. Against token replay this isn't one control among many. It is the control.

Against the vector:

• Training on unsolicited QR codes, with a literal message: a QR code arriving by email is never a legitimate authentication method
• Verification through a secondary channel — if the embassy sends you a QR code, call the embassy
• MDM/endpoint tooling capable of inspecting the URL behind a QR before access

Containment:

• Monitor post-scan credential entry
• Least privilege with periodic audit
• Report to your local FBI Field Office

Transparency note: while verifying sources we hit a cache discrepancy on the MITRE G0094 page — two closely spaced reads returned 7 and 9 aliases with different last-modified dates. It doesn't affect the technical substance, but we're flagging it.

What it teaches

Kimsuky proves that an organisation's attack surface doesn't end where its network ends. It ends where its people's attention ends — and that travels in a pocket, switches on during a commute, and has no EDR installed.

But the more uncomfortable lesson is about MFA. For years we sold it as the box to tick, the settled question, the thing that if you do it you've done the hard part. Kimsuky doesn't defeat it — it walks around it, stealing the proof that MFA has already been satisfied. The token doesn't know it was stolen. The server doesn't know it's talking to an impostor.

If your identity strategy stops at "we have MFA", against this attack you have precisely nothing.