Cofense Reports QR-Code Phishing Campaign Using Fake Iran Conflict Emergency Alerts
Summary
Cofense PDC reported a campaign impersonating government emergency alerts to drive QR-code scans. A fake human-verification page redirected users to a Microsoft-themed credential-harvesting page.
Key points
- The phishing emails impersonated Ministry of Interior and Civil Defense alerts, using urgent language about missile attacks and evacuations.
- Recipients were urged to scan a QR code for purported official emergency procedures.
- The QR code led to a fake human-verification checkbox, then redirected users to a Microsoft-themed page intended to harvest credentials.
- Cofense listed sharedfilescorps[.]com and wivoumea[.]ru among the campaign’s malicious hosting domains.
- The article recommends caution with urgent messages that demand immediate action or use QR codes, and advises verifying the source.
Article Details
- Event Type
- Phishing campaign impersonating government emergency alerts and using QR codes to direct recipients to credential-harvesting pages.
- Impact
- The campaign was designed to capture credentials through a Microsoft-themed phishing page. The article does not report confirmed credential theft or quantify affected victims.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sharedfilescorps[.]com | Identified as a malicious hosting domain for campaign pages. |
| DOMAIN | wivoumea[.]ru | Identified as a malicious hosting domain for a campaign page. |
ministryofinterior-civildefensenetwork@qualitycollection[.]com[.]au | Sender observed in the phishing email impersonating a government emergency alert. | |
| IPV4 | 104[.]128[.]128[.]129 | IP address reported as associated with campaign payload hosting. |
| IPV4 | 104[.]21[.]91[.]60 | IP address reported as associated with the campaign's infection URL hosting. |
| IPV4 | 172[.]67[.]167[.]123 | IP address reported as associated with the campaign's infection URL hosting. |
| URL | hxxps[:]//global[.]sharedfilescorps[.]com/interior/ | Malicious payload URL used in the campaign. |
| URL | hxxps[:]//ministry[.]sharedfilescorps[.]com/interior/ | Malicious infection URL used in the campaign, reached through the QR code. |
| URL | hxxps[:]//wivoumea[.]ru/HAPApOYtrk1Zzs0iF6mk@/ | Malicious payload URL used in the campaign. |
MITRE ATT&CK
T1036 · MasqueradingThe campaign masqueraded as government emergency communications and a legitimate Microsoft sign-in portal.T1566 · PhishingThe campaign used phishing emails impersonating government emergency alerts to prompt urgent action.T1566.002 · Spearphishing LinkThe QR code redirected recipients to malicious pages leading to credential-harvesting content.
Countries
IranThe ongoing conflict in the Middle East involving the United States, Israel, and Iran continues to generate widespread fear and uncertainty, particularly among civilians in affected and neighboring regions.IsraelThe ongoing conflict in the Middle East involving the United States, Israel, and Iran continues to generate widespread fear and uncertainty, particularly among civilians in affected and neighboring regions.United StatesThe ongoing conflict in the Middle East involving the United States, Israel, and Iran continues to generate widespread fear and uncertainty, particularly among civilians in affected and neighboring regions.