Google Threat Intelligence Group (GTIG) has observed increasing efforts from several Russia state-aligned threat actors to compromise Signal Messenger accounts used by individuals of interest to Russia's intelligence services. While this emerging operational interest has likely been sparked by wartime demands to gain access to sensitive government and military communications in the context of Russia's re-invasion of Ukraine, we anticipate the tactics and methods used to target Signal will grow in prevalence in the near-term and proliferate to additional threat actors and regions outside the Ukrainian theater of war.

ReliaQuest has observed a new Black Basta social engineering campaign targeting users via Microsoft Teams and malicious QR codes.

• At least two threat groups identified, one of which Netcraft can link to customs tax and postal scams carried out earlier this year.
• Up to 10,000 potential victims identified visiting this group’s phishing websites between June 19 and August 23.
• At least 2,000 form submissions, indicating how much personal data has been extracted from victims, including payment information.
• Evidence suggesting the group is running activity across Europe, including France, Germany, Italy, and Switzerland.

Les QR codes sont devenus d'incontournables moyens de paiement en Suisse. Très pratiques, ils sont néanmoins faillibles et les arnaques fleurissent, en particulier en matière de parkings. La prudence est de mise.

In this blog, we explore the modus operandi of threat actors utilizing QR code attacks, by examining recent and widespread quishing campaigns detected by Trellix.

Rail firm TransPennine Express has since removed QR codes from all of its station car parks.

Check Point’s Harmony Email team has reported a startling increase of 587% in QR code phishing or Quishing attacks.