Threat Investigation: Touch 'n Go QR Phishing Campaign
Executive Summary This report documents an investigation into a localized phishing campaign on the Threads platform. The threat actor used a fake Touch ’n Go “Money Packet” QR code to lure victims to a newly established, Cloudflare-proxied credential-harvesting domain. The investigation extracted the payload, mapped the hidden infrastructure, and produced actionable Indicators of Compromise (IOCs) with an exceptionally low initial detection rate. Technical Analysis 1. Initial Discovery & Social Engineering Tactic The investigation began with a suspicious reply under a viral, high-traffic post on Threads. ...