QR codes are relevant again for everyone from diners to threat actors
Summary: Cisco Talos reports that threat actors are using QR codes in fake parking tickets in major U.S. and U.K. cities, phony Microsoft Word documents claiming to be from the Chinese Ministry of Finance, and a fake Amazon postcard advertisement seen by a Tampa Bay CBS station in March. Talos also identified an undocumented malicious driver named RedDriver that uses the Windows Filtering Platform to intercept browser traffic, targets Chinese-language browsers, and exploits a Windows loophole allowing cross-signed kernel-mode drivers with signatures timestamped before July 29, 2015.
Bottom line: Talos observed over a dozen code-signing certificates with keys and passwords in a PFX file hosted on GitHub used with these open-source tools, and notes malicious drivers are difficult to detect heuristically and are most effectively blocked by file hash or signing certificate.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026