Distribution of Qshing Emails Disguised as Payslips

AhnLab ASEC identified a Qshing campaign impersonating the PRC Ministry of Finance where phishing emails containing QR codes redirect victims to mobile-only phishing pages that prompt for personal details and financial information. The report details email spoofing techniques, browser-width based redirection to mobile pages, the user flow that harvests names, ID numbers, credit card data and credentials, and lists associated URLs/FQDNs as IOCs.