What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Google and the FBI have documented North Korean-linked spearphishing campaigns aimed at people with expertise or work related to North Korea policy—not a broad attack on every Gmail user. The lures include fake interview or conference invitations, QR codes, malicious files, and counterfeit Google sign-in pages. If you receive an unexpected request to log in or install something, verify it independently before acting.
Who is being targeted—and what the evidence shows
Google Threat Analysis Group (TAG) says it has tracked a subset of APT43 activity it calls ARCHIPELAGO since 2012. Its reporting describes attempts to reach people with North Korea policy expertise, including government and military personnel, think tanks, policymakers, academics, and researchers in South Korea, the United States, and elsewhere. Google’s account is detailed but dates to April 2023; it should not be read as proof that every Gmail user is being targeted. Google TAG’s ARCHIPELAGO report
As an Amazon Associate I earn from qualifying purchases.
The FBI’s January 8, 2026 FLASH describes Kimsuky spearphishing using malicious QR codes against think tanks, academic institutions, and U.S. and foreign government entities. It reports a June 2025 campaign that began with a fake conference-registration path and led to a counterfeit Google account login page. The FBI’s Kimsuky reporting and Google’s ARCHIPELAGO reporting describe distinct actor labels; the sources do not establish that the names are interchangeable. FBI FLASH on Kimsuky QR-code spearphishing
The cited sources do not give a prevalence estimate for this Gmail-targeting activity. The FBI’s May and June 2025 examples are reported incidents, not a count of all attacks.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How the phishing lures work
Interview, information-request, and conference invitations
Google says ARCHIPELAGO operators may build rapport over several days or weeks through interview or information requests, then direct a target to a fake login page or malicious file. Google also documented historical fake Google Account security alerts. A plausible professional invitation can still be a credential trap, particularly if it unexpectedly asks you to sign in through a link or open a file.
QR codes that lead to counterfeit sign-in pages
A QR code in an unexpected email or message can conceal the destination until it is scanned. The FBI says a QR lure may shift a target from a managed computer to a personal mobile device, evade some email URL inspection, and lead to credential harvesting or session-token theft. Its examples include impersonation of Microsoft 365, Okta, and VPN services as well as the fake Google page described in the 2025 campaign.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A QR code does not steal a password merely because you scan it. The danger is what you do after scanning: entering credentials, approving a sign-in, or following instructions to download or open something.
Malicious browser extensions and files
Google reports that ARCHIPELAGO has used malicious Chrome extensions. It says SHARPEXT could parse email in active Gmail or AOL Mail tabs and exfiltrate it. This does not mean an ordinary extension is evidence of compromise; the warning is about extensions installed at an attacker’s direction or from an untrusted source. Be especially cautious if an unsolicited interview or research request tells you to install an extension or open a password-protected file.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
What to do if a message seems suspicious
- Do not scan an unexpected QR code in email or a message, particularly if it asks you to log in, download a file, or act urgently.
- Verify the sender through a separate, previously known channel—such as a contact method already on file—not by replying to the message or using its links.
- Open your Google account by typing its known address or using a trusted bookmark rather than following a sign-in link in the message.
- For an extension request, check the publisher and requested permissions; do not install an extension just to view a document.
- If the message concerns your organization, report it using your internal security process rather than forwarding it casually.
Account protections for people at higher risk
For people likely to be targeted, Google TAG recommends enrolling in Advanced Protection, enabling Enhanced Safe Browsing in Chrome, and keeping all devices updated. These measures address different parts of the risk: account-level protections, browser protections, and device security. Use Google’s Security Checkup to review account settings and activity. Google’s recommendations are aimed especially at potential targets, not a claim that any single setting prevents every attack.
For sensitive accounts and organizational systems, use phishing-resistant multifactor authentication (MFA) where available. The FBI recommends this for organizational systems. A phishing-resistant factor can make a stolen password less useful to an attacker, but it is a protective measure, not a guarantee that compromise is impossible.
Rank #4
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Measure | Role | What it does not replace |
|---|---|---|
| Google Advanced Protection | Account-level protection Google TAG recommends for potential targets | Careful handling of suspicious messages and device updates |
| Enhanced Safe Browsing in Chrome | Browser protection recommended by Google TAG | Verifying requests before entering credentials or opening files |
| Phishing-resistant MFA | An authentication safeguard for sensitive accounts and organizational systems | Incident reporting, account review, and other security controls |
| Keeping devices updated | Device hygiene recommended by Google TAG; the FBI also describes updates among organizational controls | Protection against every phishing or account-access technique |
What to do if you entered your password or approved an app
If you entered credentials on a suspicious page
- From a trusted device, use Google’s official account recovery and security settings. Change the exposed password.
- Review signed-in devices and account activity, then remove unfamiliar access.
- Follow your organization’s incident-reporting procedure if the account is used for work or handles organizational information.
If you granted a suspicious app access
OAuth consent phishing is a separate way attackers may gain email access: a person is tricked into authorizing a malicious app. An FBI/IC3 advisory dated September 2026 discusses this method but does not attribute it to North Korean actors. If you approved an unfamiliar app, revoke its access in your account’s security settings. Changing your password alone does not revoke an app’s token. FBI/IC3 advisory on OAuth consent phishing
Recommended Free Tools
What organizations should do
Organizations that receive suspicious QR phishing should use their internal reporting and incident-response processes. The FBI FLASH describes controls including URL analysis, device updates, and monitoring, and recommends reporting suspicious QR phishing and related activity. For employees, that means reporting the message promptly and preserving it according to organizational procedure rather than interacting with its links or code.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
