QR Code Phishing Attacks Target Chinese Citizens

A 2024 phishing campaign weaponizes QR codes embedded in MS Word documents that impersonate the Chinese Ministry of Human Resources and Social Security to lure victims into submitting name, national ID, bank card details, and banking passwords. The attackers use DGA-generated subdomains and multiple hosting IPs (notably 20.2.161.134 and related addresses) to host phishing landing pages; the report provides numerous IOCs (URLs, domains, IPs, and file hashes) and mitigation recommendations such as avoiding untrusted QR codes and using 2FA.