Scan Me: QR Codes as Emerging Malware Delivery Mechanism

The current era of contactless operations and transactions, the use of Quick Response or QR codes has become more important than before for delivering information to a large group of people. Marketing enterprises commonly use QR codes to quickly deliver information to the intended customers. However, malicious actors also use QR codes to direct potential victims to malicious websites. This research evaluates the potential use of QR codes for delivering malware to targeted users. The objective of the study is to examine if participants who have some cybersecurity awareness training identify fraudulent QR codes. The study was also designed to analyze if the subject of the QR code and poster design affect the ability to determine the validity of QR code. Thirty college students who have taken some level of computer security courses participated in the study. The participants were tasked with examining the poster carefully and scanning the QR code with their phones. They were told to not go to the websites that the QR code contained as this would reveal the validity of the link. Overall, this study shows that participants are very likely to trust QR codes as legitimate source of information even if they are not. This could expose the user to a litany of possible cyber-attacks.