Microsoft Sway abused in massive QR code phishing campaign

Netskope Threat Labs observed a massive QR-code-based phishing campaign in July 2024 that abused Microsoft Sway to host landing pages designed to harvest Microsoft 365 credentials and MFA codes. The attackers embedded phishing URLs in QR images to evade text-based email scanners and push victims to mobile devices, used Cloudflare Turnstile to maintain domain reputation and avoid blocking, and applied transparent phishing to sign victims into their accounts while displaying legitimate pages; primary targets were organizations in Asia and North America across technology, manufacturing, and finance.