Threat Investigation: Touch 'n Go QR Phishing Campaign

Mon, 05 Oct 2026 00:00:00 +0000

Executive Summary

This report documents an investigation into a localized phishing campaign on the Threads platform. The threat actor used a fake Touch ’n Go “Money Packet” QR code to lure victims to a newly established, Cloudflare-proxied credential-harvesting domain. The investigation extracted the payload, mapped the hidden infrastructure, and produced actionable Indicators of Compromise (IOCs) with an exceptionally low initial detection rate.

Technical Analysis

The investigation began with a suspicious reply under a viral, high-traffic post on Threads.

CTI on Nick Vendetta

Threat Investigation: Touch 'n Go QR Phishing Campaign

Executive Summary

Technical Analysis

1. Initial Discovery & Social Engineering Tactic