CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

 QUISHING (Phishing via QR Code) Quishing is a form of phishing that exploits QR codes to trick users into revealing sensitive information or installing malware. It combines the concept of QR (Quick Response) codes with phishing tactics—hence the portmanteau “quishing.” Here’s an in‐depth look at what quishing is and how it works: What Is Quishing? Quishing is a cyberattack where malicious actors create fraudulent QR codes that lead unsuspecting users to compromised websites or trigger harmful downloads. Unlike traditional phishing, which typically uses email or text messages containing deceptive links, quishing takes advantage of the widespread use and convenience of QR codes in everyday life. Since QR codes obscure the actual URL, a user scanning one may not realize the destination is malicious until after the scan. How Does a Quishing Attack Work? 1. Creation of a Malicious QR Code: Attackers use free online tools to generate QR codes that encode URLs pointing to phishing sites...

Quishing is phishing delivered through a QR code. It earned its own term because the QR code changes the defensive picture in ways a URL does not, and SY0-701 lists it alongside vishing and smishing. Why a QR code is different Four properties, and each one weakens a control that normally works. The destination is unreadable. A human cannot tell where a QR code points. Every piece of advice about hovering over a link and checking the domain is inapplicable — there is nothing to inspect. It defeats link scanning. Email security gateways extract and analyse URLs. A QR code arrives as an image, so unless the gateway decodes images there is no URL to scan. This is the main reason attackers adopted it, and the main reason it works. It moves the victim to a phone. The scan usually happens on a personal mobile device, outside corporate filtering, often without endpoint protection, and with a small screen that truncates the address bar so a deceptive domain is even harder to spot. It w...

Obfuscated links are URLs deliberately disguised so the recipient cannot tell where they actually lead. They are a core phishing technique, and they work because people have been trained to "check the link before clicking" without being taught what part of a link actually matters. Everything in a URL before the final domain can be faked. The only part that decides where you go is the registrable domain immediately left of the first single slash. How Links Get Disguised Mismatched display text. In HTML email, the visible text and the destination are separate. A link reading www.yourbank.com can point anywhere at all. This is the simplest technique and still the most effective. Subdomain deception. yourbank.com.secure-login.ru is a subdomain of secure-login.ru , not of yourbank.com. Readers scanning left to right see the familiar name first and stop reading. Read a domain from the right, not the left. Typosquatting and homoglyphs. arnazon.com with rn in place...

Smishing is phishing delivered by SMS. It gets its own term on the Security+ syllabus because the channel changes the defensive picture, not because the social engineering differs. Why SMS works for attackers No gateway. Email passes through filtering that scans links, checks sender reputation and validates SPF, DKIM and DMARC. SMS arrives directly on the device with none of that. Higher trust and urgency. People treat texts as more personal and more immediate than email, and read them within minutes. That compresses the time available for second thoughts, which is exactly what social engineering depends on. Small screen. The address bar truncates, so a deceptive domain is harder to spot. Link previews are limited or absent. Shortened links are normal. Character limits made short links routine in SMS, so a message with an opaque link raises no suspicion at all. Personal devices. The phone is often outside corporate management, without endpoint protection or web filtering. S...

A phishing campaign, in the Security+ sense, is an internal simulation: you send your own staff a realistic but harmless phishing email, measure what happens, and use the result to target training. The exam treats it as a security awareness control, and the questions tend to be about what you measure and how you run it responsibly rather than how to craft the email. Why simulate at all Technical controls stop a great deal of phishing, and some still arrives. Once it does, the decision rests with a person. Training that consists of an annual slide deck does not change behaviour under time pressure; practice does, and the only way to know whether it worked is to measure. Simulations also find where the risk is concentrated. A finance team that handles payment changes is a different exposure from a warehouse team that rarely uses email, and the response should differ. Running one Get authorisation first. Written approval from senior management, and involve HR and legal before anyth...

A shortened URL hides its destination behind a redirect. That is useful for sharing and it is a problem for security, because the advice everyone gives — check the link before you click — becomes impossible to follow. Why shorteners are a security problem The destination is invisible. A short link gives no indication of where it goes. Domain reputation, spelling and the path are all hidden. Reputation is inherited. The shortener's domain is well known and widely allowed, so the link inherits trust the actual destination has not earned. Blocking the shortener wholesale breaks a great deal of legitimate traffic. The destination can change. Many services let the owner edit the target after the fact. A link that passed inspection when the email was delivered can point somewhere else by the time the user clicks — which defeats scan-at-delivery entirely. Chained redirects. Several shorteners in sequence frustrate automated analysis and add hops that filters may not follow. Trac...

Phishing, Spear Phishing, and Whaling Oct 9, 2026 · @Ken Phishing, spear phishing, and whaling are all email-based social engineering attacks, and for the Security+ exam , CompTIA wants you to tell them apart by one thing: how precisely the attacker aimed. What Separates Them Phishing is the broadest and least targeted category. An attacker blasts the same message — a fake invoice, a password reset warning, a shipping notice — to thousands of addresses, betting that a small percentage of recipients will click without thinking. It relies on no research or customization; volume does the work. Spear phishing narrows that net. The attacker researches a specific target — usually a department or a company — and writes a message that references something real: a vendor name, an internal project, a coworker's name pulled from LinkedIn. Because it looks like it belongs in the recipient's inbox, spear phishing converts at a much higher rate than generic phishing, even though it reaches f...