Phishing with Cookies

Before COVID-19 hit, MobileIron (acquired by Ivanti) was preparing for a global shift toward a remote workforce. While the speed and intensity of the shift caught the world off guard, MobileIron was ready. MobileIron’s Everywhere Enterprise theme emphasized the security infrastructure demanded by a zero trust world. Pillars of this theme include a thought leadership and educational campaign along with a suite of phishing protections designed to support the growing remote workforce. While the industry had been dominated by security leaders Google and Proofpoint, their solutions didn’t prevent enough attacks – especially as threats shifted during the pandemic, particularly toward QR codes.
QR codes became ubiquitous during the pandemic for touch-free information — and hackers seized on consumers’ lack of ability to distinguish between safe and malicious codes. MobileIron set out to increase awareness and protect against this rising threat.
Cookie, anyone?
MobileIron tempted media and influencers with hand-delivered sugar cookies with a QR code iced onto their surface – with no context. Mission: elicit curiosity. It worked. The code led to a landing page explaining the risks of following links and QR codes from an unknown source.
The page also offered one-click booking for follow-up briefings, and extended to social media with scannable ‘virtual cookies’.
The impact:
• 97% of recipients scanned their cookies.
• 10 high-profile media articles in key publications.
• Coverage as a main topic on a top cybersecurity podcast.
• 25% increase in product trials from June (when the campaign launched) to July.
• 43% increase in new Annual Recurring Revenue Pipeline from the prior period.
• Q2 earnings up 16%, despite reports that security spending would go down.
MobileIron amplified the messaging with a follow-up survey/video on security risks associated with QR codes, which revealed jarring knowledge and security gaps. The survey findings generated coverage in numerous publications across key verticals.
Capitalizing on this exposure, the team held media briefings resulting in more than 100 articles with mentions in Business Insider, Wall Street Journal, Forbes, and BBC. People still ask for cookies.