WhatsApp spear phishing campaign uses QR codes to add device

Microsoft details a Russia-linked group called Star Blizzard (aka Coldriver) running a spear-phishing campaign against journalists, think-tank members, and NGO staff by using staged relationships and QR-code based lures; targets are first engaged via impersonation, then sent a broken QR to prompt a reply and subsequently a shortened link to a second QR that—if followed—adds an extra device to the victim's WhatsApp account, enabling the attackers to read messages and export conversations.