When the user scans the QR code, they will be taken to a phishing website that attempts to steal their login credentials by impersonating a Microsoft account. Although this phishing attack's ultimate objective is not new, its use of corrupted Word documents is a fresh strategy for avoiding detection. Because most security solutions do not follow the correct protocols for their file types, these files continue to function correctly within the operating system.

All antivirus programs reported "clean" or "Item Not Found" when they were uploaded to VirusTotal since they were unable to adequately analyze the file. The purpose of these attachments has been achieved with some degree of success. Only a few of the attachments that researchers shared that were used in this campaign were detected by two vendors, and nearly all of them had zero detections. However, the fact that the documents only show a QR code and no harmful code has been inserted could also be the reason for this.

Users can still defend themselves against this phishing attempt by following the standard guidelines. Users should delete emails from unknown senders right away or get confirmation from a network administrator before viewing them, especially if they include attachments.

Impact

• Security Bypass
• Credential Theft

Indicators of Compromise

MD5

• 1d334faf2c8988c418e86eef56880a34

SHA-256

• bd15a28702d654446ab118d30687074979280444b64f6dbaa6345e5f92c78938

SHA1

• 67191d49867dcbceedd97b56a1c0f2687df99fef

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Employ network intrusion detection and prevention systems to monitor and block malicious network activities.
• Implement network segmentation to limit lateral movement for attackers within the network.
• Never trust or open links and attachments received from unknown sources/senders.
• Implement advanced email filtering to detect and block phishing emails.
• Employ updated and robust endpoint protection solutions to detect and block malware.
• Develop and test an incident response plan to ensure a swift and effective response to security incidents.
• Enhance logging and monitoring capabilities to detect anomalous activities and unauthorized access.
• Conduct regular security audits and penetration testing to identify and address potential vulnerabilities.
• Regularly back up critical data and ensure that backup and recovery procedures are in place.