Phishing with QR codes

Don’t Scan or be Scammed

By Maharlito Aquino, Kervin Alintanahin and Dexter To

In 1994, a type of the matrix barcode known as the Quick Response code, now widely known as QR code, was invented by Masahiro Hara from a Japanese company Denso Wave. The purpose of the barcode was to keep track of automotive parts manufactured by Denso Wave. Nowadays, QR codes are applied to a much broader context and are a commonly used to display text to mobile phone users, to connect to a wireless network, open a webpage on a mobile device, and more.

Back in 2021, we reported the resurgence of phishing attacks leveraging QR codes to deliver phishing URLs to customers of a German bank.

Today, we see a new phishing campaign targeting Chinese customers of a mobile payment service. The phishing emails masquerade as notifications of wage subsidies from the Ministry of Finance of the People’s Republic of China, urging recipients to apply immediately.

Figure 1. Phishing email containing a DOCX attachment (translated)

The email contains a DOCX attachment in the OpenXML document format; the attachment provides instructions on how to claim employment subsidies via a mobile payment service that is widely used in Southeast Asia. To ensure everyone’s safety, we have redacted parts of the QR code image in the screenshot below.

Figure 2. Contents of document containing a malicious QR code

Table 1. Translated body of the document

Once a recipient scans the QR code on a mobile device, their mobile browser opens a link with a .cn domain and is immediately redirected to a .click domain.

Figure 3. Landing page of the malicious QR code

Table 2. Translation of the landing page prompt

Clicking on the prompt loads the following phishing page.

Figure 4. Phishing page targeting China UnionPay QuickPass Users

Entering an invalid bank card number will result in a prompt that translates to “The bank card number you entered is incorrect!”

Figure 5. Error Prompt When Entering an Invalid Bank Card Number

When a valid bank card number is entered, the user is redirected to another page that requires additional information, which is commonly used to update banking information through customer support.

Figure 6. The Phishing Page Gathering User Account Info

This phishing site includes a lot of data validation, especially for the most important data, the bank card number.

It is also worth noting that when the link from the QR code is accessed from a desktop browser, the user is prompted to use a mobile phone to access the link, as shown below.

Figure 7. Error prompt clicking the QR code with a desktop browser

Indicators of compromise