{
  "name": "The Hidden Danger of PDF Files with Embedded QR Codes",
  "slug": "the-hidden-danger-of-pdf-files-with-embedded-qr-codes",
  "description": "The report describes how malware authors are abusing PDF files with embedded QR codes to deceive users into visiting malicious phishing URLs disguised as legitimate services. The QR codes redirect users to fake Microsoft login pages designed to harvest credentials and potentially gain unauthorized access to sensitive data. The report details the techniques used, potential consequences, and provides indicators of compromise (IOCs) and SonicWall protection signatures.",
  "published": "2024-07-05T13:37:17+00:00",
  "created_at": "2024-07-05T13:37:17+00:00",
  "modified_at": "2024-07-05T14:21:57+00:00",
  "created_at_opencti": "2024-07-05T13:37:17+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-05",
    "credential-theft",
    "malicious urls",
    "pdf files",
    "phishing",
    "qr codes"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "68d72745079d00909989c92141255ba530490cd361a26ee1f4083acf35168c45"
      }
    ],
    "attack_patterns": [
      {
        "id": "385899dc-961e-47ac-afdd-cced19228f7f",
        "name": "T1535"
      },
      {
        "id": "855af033-2ea1-40fa-98cd-2e5a4430d650",
        "name": "T1599"
      },
      {
        "id": "c10eac8a-a5d7-465a-b557-8a1f7fc6ef99",
        "name": "T1598.003"
      },
      {
        "id": "4abf44e7-0c8c-48fc-9cc5-12fc33f919b6",
        "name": "T1211"
      },
      {
        "id": "7616ff60-a18f-4663-9824-b889aa01c8ce",
        "name": "T1588"
      },
      {
        "id": "00430919-9257-403b-8a1b-958d4c3613aa",
        "name": "T1557"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "74d5f31c-5e2d-4aed-b8b9-4fabdde76dfa",
        "name": "T1598"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://blog.sonicwall.com/en-us/2024/07/the-hidden-danger-of-pdf-files-with-embedded-qr-codes/",
    "https://otx.alienvault.com/pulse/6688132da74a7dbcd8876bf9"
  ]
}