https://thenickvendetta.pages.dev/tags/quishing/Recent content in Quishing on Nick VendettaHugoenWed, 07 Oct 2026 00:00:00 +0000https://thenickvendetta.pages.dev/writeups/tng-qr-phishing-analysis/Wed, 07 Oct 2026 00:00:00 +0000https://thenickvendetta.pages.dev/writeups/tng-qr-phishing-analysis/<h2 id="executive-summary">Executive Summary</h2> <p>This report documents an investigation into a localized phishing (&ldquo;quishing&rdquo;) campaign distributed on the Threads platform. The Threat Actor used a fake Touch &rsquo;n Go (TNG) &ldquo;Money Packet&rdquo; QR code to lure victims to a newly established, Cloudflare-proxied domain.</p> <p>Initial passive OSINT suggested a conventional credential-harvesting site. Further manual live forensics showed that the <strong>true objective is full Telegram account takeover</strong>, not theft of TNG eWallet credentials. The TNG branding is only the pretext. The backend relays the victim&rsquo;s phone number to the real Telegram login system and then solicits the resulting one-time passcode (OTP) and two-factor (2FA) password.</p>