As someone who is working in incident response and malware analysis I have to say that is one of the worst ideas I have ever seen.

As someone who is working in incident response and malware analysis I have to say that is one of the worst ideas I have ever seen. A lot of companies have issues with ClickFix [1] and other social engineering campaigns and now Google wants to teach users that they should scan QR codes to proceed on a website. How should we realistically teach Susan from HR the difference between a real Google Captcha QR code and a malicious phishing QR code - you (realistically) can't. I wish we could - but those people don't work in tech, they will never know and I can't really blame them because at the end of the day they are just happy that they don't have to deal with tech after work. We have spent years of behavioural conditioning to prevent QR-code based phishing attacks (some people call it Quishing but I hate that term) and since the QR code is being scanned from a mobile device (99.99% of the time the private device), we have no EDR visibility on those devices and can't track what's happening if people scan it. This is more of an invitation for threat actors than it is something that holds them back. [1] https://www.kaspersky.com/blog/what-is-clickfix/53348/

Posted by mafriese on May 7, 2026, 5:40 AM

Tags

• complaint (Other)

Related issues

• I wish there was something that could be done beyond feeling powerless.
• I don’t hate taxes per se but I hate that the government will take tax dollars earmarked for one purpose, which is how they got the tax a...
• I've never thought SF Symbols were beautiful.
• > conservatives don't like being told that their ideas, while legally allowed, are not welcome in polite company As long as there are a ...
• Yeah but this AI music is worse than any AI produced code.
• I wish there was a way I could get educational-only youtube as an adult.