Staff notice stickers with QR codes placed over the official payment codes on parking meters outside the office. Scanning one opens a look-alike payment page. Which threat vector category does this represent?
Select an answer to reveal the explanation.
Short Explanation
Think about it -- the attack is literally a picture you point your phone at. A QR code hides a URL you can't read with your eyes, so swapping in a fake one is an image-based vector. Don't get distracted because the sticker is physical; the payload is the code inside the image.
Full Explanation
Image-based threat vectors carry malicious content or links inside images, including QR codes, embedded content and fake CAPTCHA challenges. A QR code encodes a URL that a person cannot verify before scanning, so replacing a legitimate code with a fraudulent one sends victims to an attacker's page while appearing normal; the related social engineering technique is often called quishing. A message-based vector would deliver the lure through email, SMS, RCS, instant messaging or collaboration tools, but here no message was sent; the lure waited on the meter. A physical-based vector involves locks, access vestibules or access passes to gain entry to a facility, and nobody is attempting to enter a building. A signal-based vector abuses Bluetooth, radio frequency or near-field communications; scanning a QR code is an optical action using the camera, not a wireless exchange with the meter. Exam caveat: the sticker is placed physically, but classification follows the mechanism that delivers the malicious link. Operational check: report the tampered meters to the operator, warn staff not to pay through scanned codes when an official app or posted web address exists, and check whether corporate devices with mobile security tools flagged the destination domain.