QR didn't open? Contact support.

QR code didn’t open? Contact support 🆘

In mid-January, the PT ESC cyber intelligence team detected a phishing campaign disguised as notifications from government agencies.

1️⃣ The victim receives an email with a PDF document: inside is a QR code for accessing documents and a Telegram contact for technical support in case of issues.

2️⃣ When scanning the QR code, the page turns out to be inaccessible — and this is part of the scenario: the user is pushed into a conversation with scammers.

3️⃣ During the correspondence, they ask for the sender’s full name and phone number, and then provide a new link — supposedly to pay for delivery.

4️⃣ The website visually mimics the interfaces of legitimate services, but the money goes to the attackers 💰

The article on Habr provides a detailed breakdown of the fraudulent scheme and offers simple recommendations for quickly verifying the legitimacy of an email.

#TI #Phishing
@ptescalator