QR Code Phishing

A QR payload is usually a URL, sometimes a Wi-Fi config string, sometimes a deep link into an app. Your camera or a scanner app decodes the bits and offers to open them. Many phones show a domain banner before the browser loads. That banner is the whole remaining inspection surface — the equivalent of hovering a link on a laptop. If you tap through without reading it, you volunteered the same trust you would give a typed official site, without ever seeing the characters. An overlay works because humans trust the furniture: the meter, the table, the framed Wi-Fi sign. The attacker does not need you to believe a random email. They need you to believe the parking garage. Raised edges, mismatched laminate, a code taped over another code, a tent card that looks newer than the table — those are physical tells. You inspect them the way you inspect a shipping label. You do not peel codes, replace them, or "test" a suspicious sticker by scanning it. Walking away is the control. Pay in the official app you already have, or type the operator's site yourself.

Parking, restaurant, and office Wi-Fi are high-value because the story is ordinary. Parking: scan to pay, land on a page that asks for the same password you use at work — or a card number on a host that is not the city or the garage brand you would type. Restaurant: scan for the menu, land on a "survey + prize" login. Office: a printout "New Wi-Fi — scan to join" that is not from IT, asking for SSO. Work QR codes that "keep email working" or "enroll the new VPN" should come through a channel you already trust, not a hallway flyer you cannot attribute. When in doubt, type the official site or open the official app from the store listing you already use. The QR is optional convenience, not a requirement to complete a real payment or a real login.

Safe scanning is three habits. First: look at the physical code. Overlay, peel, wrong paper, a flyer in a place that should be a printed plate — refuse. Second: read the URL preview on YOUR camera before anything opens. The host should match the business you think you are talking to — not a lookalike, not an extra hyphen, not a random .xyz that says "secure-pay." Third: if the preview is wrong or you have any doubt, do not debug the sticker. Type the official site yourself or use the official app. That is the same "open the bank app, do not click the email" rule from Module 1, applied to photons. Wi-Fi QR codes can encode a network name and password. A hallway sticker is not a reason to join an attacker-controlled AP. Prefer the SSID the venue posted in a durable, consistent place — or skip Wi-Fi and use cellular, which you already practiced in Topic 4. Do not scan a code to install a configuration profile or a certificate unless you initiated that enrollment on a device you administer, from documentation you typed. A surprise profile is a persistence mechanism, not a menu.

The lab-shaped temptation is to wander a garage "collecting" codes. That is out of scope. You might open a phishing host, you might look like you are tampering with payment furniture, and you learn nothing you cannot learn from a code you generated. Create a QR that encodes https://example.com (or another URL you already trust), or use a known-good code you already own: a home Wi-Fi card, a ticket in YOUR email, a package label on a box that is yours. Scan that. Practice reading the preview. Cancel instead of opening if you want to drill the pause. Never scan random public stickers as homework. Never print a lookalike to stick over a real one.

Generate a QR that points only at https://example.com, or skip generation and use a known-good code already in your house. The mission is the preview habit, not a collection of stranger URLs. Write the notes to a file you own. Do not paste other people's Wi-Fi passwords into it. If qrencode or Python is missing, the camera drill on a code you already trust is enough.

mkdir -p "$HOME/cyberlium-lab"

chmod 600 "$HOME/cyberlium-lab/example-com.png"
Python alternative (only if YOU already have a QR library you trust):
  python3 -c "import qrcode; qrcode.make('https://example.com').save('$HOME/cyberlium-lab/example-com.png')"

READ the preview banner. Do not tap yet.

{
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo "=== source (must be yours) ==="
  echo "payload: https://example.com  OR  known-good code I already own (describe, no secrets): "
  echo "generated_with: qrencode / python / skipped_used_existing"
  echo "=== preview on MY phone ==="
  echo "banner_showed_before_open: yes/no"
  echo "host_i_read: "
  echo "matched_expected: yes/no"
  echo "i_opened_anyway: yes/no  (opening example.com is optional)"
  echo "=== wild overlay policy (do not scan as lab) ==="
  echo "if_i_see_a_taped-over_public_code: walk_away / official_app / type_site — never_scan_to_test"
  echo "ethics: did not scan random parking/restaurant stickers, did not place overlays"
} > "$HOME/cyberlium-lab/qr-preview.txt"
chmod 600 "$HOME/cyberlium-lab/qr-preview.txt"

You now treat a QR as a link you did not type: inspect the physical code, read the preview, and when in doubt type the official site or use the official app. Parking, menus, and office Wi-Fi are convenience, not orders. Next — AI-Powered Scams (2026) — a familiar voice is no longer proof: clones from short clips, fluent phishing with no typos, and callback on a number you already have.