Security News > 2021 > December > Phishing attacks use QR codes to steal banking credentials
A new phishing campaign that targets German e-banking users has been underway in the last couple of weeks, involving QR codes in the credential-snatching process.
If the embedded button is clicked, the victim arrives at the phishing site after passing through Google's feed proxy service 'FeedBurner.
The actors register their own custom domains that are used for these re-directions as well as for the phishing sites themselves.
In the most recent phishing campaigns, the threat actors use QR codes instead of buttons to take victims to phishing sites.
Once the victim arrives on the phishing site, they are requested to enter their bank location, code, user name, and PIN. If these details are entered on the phishing page, the user waits for validation and then is prompted to enter their credentials again due to them being incorrect.
This repetition is a common quality tactic in phishing campaigns to eliminate typos when the user enters their credentials the first time.
News URL
Related news
- New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials (source)
- Phishing platform 'Lucid' behind wave of iOS, Android SMS attacks (source)
- Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware (source)
- Australian pension funds hit by wave of credential stuffing attacks (source)
- Phishing kits now vet victims in real-time before stealing credentials (source)
- iOS devices face twice the phishing attacks of Android (source)
- Phishing Campaigns Use Real-Time Checks to Validate Victim Emails Before Credential Theft (source)
- Windows NTLM hash leak flaw exploited in phishing attacks on governments (source)
- CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download (source)
- Three Reasons Why the Browser is Best for Stopping Phishing Attacks (source)