{"id":25691,"date":"2025-01-17T09:10:06","date_gmt":"2025-01-17T17:10:06","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2025\/01\/17\/news-19414\/"},"modified":"2025-01-17T09:10:06","modified_gmt":"2025-01-17T17:10:06","slug":"news-19414","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2025\/01\/17\/news-19414\/","title":{"rendered":"WhatsApp spear phishing campaign uses QR codes to add device"},"content":{"rendered":"\n<p>A cybercriminal campaign linked to Russia is deploying <a href=\"https:\/\/www.malwarebytes.com\/cybersecurity\/basics\/what-is-a-qr-code\">QR codes<\/a> to access the WhatsApp accounts of high-profile targets like journalists, members of think tanks, and employees of non-governmental organizations (NGOs), <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/01\/16\/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">according to new details revealed by Microsoft<\/a>.<\/p>\n<p>The group, which Microsoft tracks by the name &#8220;Star Blizzard,&#8221; is also referred to as Coldriver by other researchers. Last year, the group created impersonation accounts where members posed as experts in a field that their targets might be interested in\u2014or that was somehow affiliated with the target. Once a relationship had been established, the target would receive a phishing link or a document that contained a phishing link.<\/p>\n<p>But over time, that tactic became widely known, and part of the cybercriminals&#8217; <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/12\/07\/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">infrastructure was taken down<\/a>. Now, it seems the group has changed tactics and is sending QR codes instead of malicious links to the targets that they have established an initial relationship with.<\/p>\n<p>These QR codes do not take the target to a malicious website, nor will they join them to the promised WhatsApp group on \u201cthe latest non-governmental initiatives aimed at supporting Ukraine NGOs,\u201d as is claimed in one of the cybercriminal lures. <\/p>\n<p>In reality, the link in the QR code is intentionally broken. The idea is that the target will respond with a remark about the broken link. When that happens the cybercriminals send out a <a href=\"https:\/\/www.malwarebytes.com\/blog\/news\/2015\/09\/obfuscated-urls-where-is-that-link-taking-you\">shortened URL<\/a> to a website that displays another QR code.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"863\" height=\"185\" src=\"https:\/\/www.malwarebytes.com\/wp-content\/uploads\/sites\/2\/2025\/01\/wrapped_and_shortened_link.jpg\" alt=\"obfuscated and shortened link\" class=\"wp-image-147828\" \/><figcaption class=\"wp-element-caption\"><em>Screenshot courtesy of Microsoft<\/em><\/figcaption><\/figure>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>&#8220;I apologize for the inconvenience with the QR code. Kindly try this alternative link: <a href=\"http:\/\/t.ly\">US-Ukraine NGOs Group<\/a><br \/>It should work without any issues.<\/p>\n<\/blockquote>\n<p>By scanning this QR code and following the instructions on the website they confirm the addition of an extra device to the WhatsApp account of the target. With that access the group can read the messages in their WhatsApp account and use existing browser plugins, particularly those designed for exporting WhatsApp messages from an account accessed via WhatsApp Web.<\/p>\n<h2 class=\"wp-block-heading\" id=\"h-how-to-stay-safe\">How to stay safe<\/h2>\n<p>These spear phishing campaigns are highly targeted and you\u2019ll probably never see an invite to this group. But cybercriminals tend to copy ideas that work, so you may see them in another form.<\/p>\n<p>There are a few simple rules that will help you avoid this kind of phishing.<\/p>\n<ul class=\"wp-block-list\">\n<li>Always hover over links before clicking them.<\/li>\n<li>When you find a shortened URL, think about the possible reason for shortening. Was there a real need to do this or is it just meant to hide the destination?<\/li>\n<li>When still in doubt, unshorten the URL.<\/li>\n<li>When following instructions on a website, scrutinize whether the prompts on your device actually match the expected ones. WhatsApp will double-check whether you want to add a device to the account.<\/li>\n<li>Double-check whether the sender is who they claim to be through another method of contact.<\/li>\n<\/ul>\n<hr class=\"wp-block-separator alignfull has-alpha-channel-opacity is-style-wide\" \/>\n<p><strong>We don\u2019t just report on phone security\u2014we provide it<\/strong><\/p>\n<p>Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by\u00a0<a href=\"https:\/\/www.malwarebytes.com\/ios\">downloading Malwarebytes for iOS<\/a>, and <a href=\"https:\/\/www.malwarebytes.com\/android\">Malwarebytes for Android<\/a> today.<\/p>\n<p><a href=\"https:\/\/www.malwarebytes.com\/blog\/news\/2025\/01\/whatsapp-spear-phishing-campaign-uses-qr-codes-to-add-device\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p> A cybercriminal campaign linked to Russia is deploying QR codes to access the WhatsApp accounts of high-profile targets like journalists, members&#8230; <\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[27288,32,22519,30756,10438,10440],"class_list":["post-25691","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-coldriver","tag-news","tag-qr-code","tag-star-blizzard","tag-threats","tag-whatsapp"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/25691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=25691"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/25691\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=25691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=25691"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=25691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}