Loading story…
In April 2025, a boutique inventory management firm in Boise, Idaho, suffered a $75,000 loss after malware was delivered via a malicious QR code label. The attack, dubbed 'CodeGhost,' exploited previously unknown vulnerabilities in both Windows 11 Pro and Ubuntu 22.04. The incident highlights the risk of physical-to-digital attack vectors and the need for vigilance around supply chain and device security.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos Incident Response reported that phishing became the leading initial access vector in more than half of investigated incidents, with authentication abuse rising to 65% of cases. The firm highlighted an ongoing QR-code phishing campaign attributed to **UAT-11764** that targeted mainly Australian organizations using compromised Microsoft 365 accounts, tailored PDF attachments, and SharePoint- or other trusted cloud-hosted credential harvesting pages. After stealing credentials, the attackers accessed victim inboxes, created inbox rules to evade detection, and used the compromised accounts to spread additional phishing internally and externally. Talos also warned that phishing-as-a-service platforms such as **ARToken** are expanding attacker capabilities with device-code phishing, token abuse, **OAuth** device authorization flow abuse, persistent access via Primary Refresh Tokens, business email compromise, and SharePoint data exfiltration. In ransomware and pre-ransomware cases, including **Sinobi** and **Warlock** activity, operators maintained stealthy access by abusing legitimate remote management tools such as a trojanized **MeshAgent** binary and **Zoho Assist**. Healthcare was the most targeted sector, and Talos urged organizations to deploy phishing-resistant MFA, improve logging, patch exposed systems faster, and limit outbound email rates to reduce propagation.
Aug 25, 2026Microsoft said attackers are increasingly using **QR-code phishing** to steal credentials, with the company analyzing **8.3 billion** email-based phishing threats in Q1 2026 and recording a **146% increase** in quishing activity. Researchers said more than **35,000 users** across roughly **13,000 organizations** were targeted through emails, PDFs, and fake CAPTCHA pages carrying malicious QR codes that redirected victims through multiple sites to counterfeit login portals. Microsoft also reported a **336% surge** in QR codes embedded directly in emails in March, alongside continued business email compromise lures and phishing kits such as **Tycoon2FA**, which it disrupted with Europol before operators began rebuilding infrastructure and shifting toward `.RU` domains. The warning follows a separate Microsoft 365 security incident in which faulty heuristic anti-phishing rules in Exchange Online and Teams wrongly flagged legitimate content as malicious. The incident, tracked as **`EX1227432`**, caused valid emails to be quarantined, links to be blocked, **Zero-hour Auto Purge (ZAP)** actions to trigger incorrectly, and false **Microsoft XDR** alerts to be sent after a logic error misclassified legitimate URLs as phishing links. Microsoft said the outage was prolonged by bugs in related signature and rollback systems, underscoring how both attacker evasion and defensive misfires can disrupt cloud email security and credential protection efforts.
Jun 29, 2026A hacker compromised 18 widely used npm packages by phishing a developer and injecting cryptocurrency-stealing malware. The attack leveraged a typosquatted domain to obtain credentials, resulting in malicious code being pushed to packages with over two billion weekly downloads. The financial impact was limited, but the incident highlights critical supply chain and open-source security risks.
Jun 29, 2026