Quishing in the Wild: Anatomy of a Corporate HR Lure Using QR Codes, AWS S3, and Cloudflare Turnstile
TLP: WHITE — This analysis is cleared for public release. All victim PII has been redacted. No credentials were submitted during analysis. IOCs are provided at the end for detection use. Overview A live QR phishing (“quishing”) campaign was captured in the wild targeting corporate employees via a weaponized PDF disguised as an employee handbook. This isn’t a commodity phish — it’s a toolkit-grade, multi-stage attack built specifically to defeat automated email scanners, security sandboxes, and network proxies. ...