{"id":68157,"date":"2024-06-19T12:37:04","date_gmt":"2024-06-19T12:37:04","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=68157"},"modified":"2024-06-19T13:57:56","modified_gmt":"2024-06-19T13:57:56","slug":"weaponized-documents-qr-code-phishing","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/weaponized-documents-qr-code-phishing\/","title":{"rendered":"Hackers Using Weaponized Word Documents In QR Code Phishing Attacks"},"content":{"rendered":"\n

Hackers often abuse weaponized Word docs, as they can contain macros that contain or exploit flaws inside those Word files to run destructive code upon being opened by the intended victims.<\/p>\n\n\n\n

It enables an attacker to employ this tool to deliver a payload to a target system or unauthorized access to a targeted system by simply sending the target an innocent file with a Word extension, most of the time evading the security systems.<\/p>\n\n\n\n

Cybersecurity researchers at Cyble discovered that hackers have been actively using weaponized Word documents in QR code phishing<\/a> attacks.<\/p>\n\n\n\n

QR Code Phishing Attacks<\/strong><\/h2>\n\n\n\n

QR code phishing attacks<\/a> have surged recently, exploiting the technology’s all-presence and users’ familiarity to redirect them to credential-stealing sites.<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan<\/a><\/code><\/strong><\/strong><\/p>\n\n\n\n

In 2024, such attacks increased by 22% compared to late 2023, with 89.3% aimed at stealing credentials per Abnormal Security. <\/p>\n\n\n\n

Threat actors embed malicious QR codes in emails, documents, and public places, using them to mask destinations. <\/p>\n\n\n\n

A recent campaign used Microsoft Word docs impersonating Chinese government agencies with undetected QR codes prompting users to authenticate for fake subsidies, aiming to harvest financial data like in a January 2023 incident documented by Fortinet.<\/p>\n\n\n\n

The malicious QR code redirects victims to a domain generated by a DGA, hosting a phishing site impersonating China’s Ministry of Human Resources. <\/p>\n\n\n

\n
\"\"\/
Phishing site (Source – Cyble)<\/figcaption><\/figure><\/div>\n\n\n

This domain resolves to IP 20.2.161.134, which hosts several other subdomains (.tiozl.cn and .zcyyl.com) linked to the massive phishing campaign, reads Cyble report<\/a>.<\/p>\n\n\n\n

The SSH host key fingerprint ties this IP to 17 others in Hong Kong’s AS8075, bearing similar phishing URLs. Landing pages display fake labor subsidy lures, then harvest entered personal details like names and national IDs from victims.<\/p>\n\n\n\n

Finally, the phishing site prompts victims to enter bank card numbers, phone numbers, and balances on behalf of false verification, which enables unauthorized transactions after they have harvested names and IDs.<\/p>\n\n\n\n

This loading screen is followed by a prompt for withdrawal passwords used to make domestic credit card payments.<\/p>\n\n\n\n

Attackers can consequently conduct unauthorized transactions with the full details of a card, and these passwords<\/a> can lead to financial losses.<\/p>\n\n\n\n

In other words, this advanced QR code phishing scam capitalizes on trusted technology and tricks to steal financial information, effectively highlighting the mounting danger necessitating increased alertness.<\/p>\n\n\n\n

Recommendations<\/strong><\/h2>\n\n\n\n

Here below we have mentioned all the recommendations:-<\/p>\n\n\n\n