Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon
Summary: Since late 2024, Unit 42 researchers have observed new QR code phishing tactics, including concealing the final phishing destination through legitimate websites' redirection mechanisms and adopting Cloudflare Turnstile for user verification to evade security crawlers. The campaigns, spread across the U.S. and Europe and hitting the medical, automotive, education, energy and financial sectors, spoof Docusign and Adobe Acrobat Sign documents and embed phishing URLs in QR codes so victims scan them on personal devices with weaker controls.
Why it matters: Some fake login pages reject arbitrary credentials and display error messages, indicating attackers are working from a targeted list of victim names and harvesting credentials selectively - so a single scan by the right employee is the whole attack, not a lucky guess.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026