Scanception: A QRiosity-Driven Phishing Campaign

**Executive summary:** CRIL/Cyble researchers describe an active, global quishing campaign called "Scanception" that uses QR codes embedded in realistic PDF lures to direct victims to adversary-in-the-middle (AITM) credential-harvesting pages; the campaign leverages trusted platforms and open redirectors, employs sandbox/automation detection and randomized exfiltration endpoints, targets high-value sectors across multiple regions, and has produced over 600 unique PDF/email lures with many samples undetected by VirusTotal.