Microsoft Sway abused in massive QR code phishing campaign

Share:

​A massive QR code phishing campaign abused Microsoft Sway, a cloud-based tool for creating online presentations, to host landing pages to trick Microsoft 365 users into handing over their credentials.

The attacks were spotted by Netskope Threat Labs in July 2024 after detecting a dramatic 2,000-fold increase in attacks exploiting Microsoft Sway to host phishing pages that steal Microsoft 365 credentials. This surge sharply contrasts the minimal activity reported during the year’s first half, showing the large scale of this campaign.

They primarily targeted users in Asia and North America, with the technology, manufacturing, and finance sectors being the most sought-after targets.

The emails redirected potential victims to phishing landing pages hosted on the sway.cloud.microsoft domain, pages that encouraged the targets to scan QR codes that would send them to other malicious websites.

Attackers often encourage victims to scan QR codes using their mobile devices, which typically come with weaker security measures, thus increasing the chances of bypassing security controls and allowing them to access phishing sites without restrictions.

“Since the URL is embedded inside an image, email scanners that can only scan text-based content can get bypassed. Additionally, when a user gets sent a QR code, they may use another device, such as their mobile phone, to scan the code,” the security researchers explained.

“Since the security measures implemented on mobile devices, particularly personal cell phones, are typically not as stringent as laptops and desktops, victims are then often more vulnerable to abuse.”

The attackers employed several tactics to further boost their campaign’s effectiveness, like transparent phishing, where they stole the credentials and multi-factor authentication codes and used them to sign the victims into their Microsoft accounts while showing them the legitimate login page.

They also used Cloudflare Turnstile, a tool intended to protect websites from bots, to hide their landing pages’ phishing content from static scanners, helping to maintain the phishing domain’s good reputation and avoid getting blocked by web filtering services like Google Safe Browsing.

Microsoft Sway was also abused in the PerSwaysion phishing campaign, which targeted Office 365 login credentials five years ago using a phishing kit offered in a malware-as-a-service (MaaS) operation.

As Group-IB security researchers revealed at the time, those attacks tricked at least 156 high-ranking individuals at small and medium financial services companies, law firms, and real estate groups.

Group-IB said that over 20 of all harvested Office 365 accounts belong to executives, presidents, and managing directors at organizations in the U.S., Canada, Germany, the U.K., the Netherlands, Hong Kong, and Singapore.

Sergiu Gatlan

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
11:52 pm, Jul 6, 2025
weather icon 17°C
L: 16° | H: 18°
scattered clouds
Humidity: 71 %
Pressure: 1007 mb
Wind: 10 mph WNW
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 40%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:51 am
Sunset: 9:18 pm
DailyHourly
Daily ForecastHourly Forecast
Tomorrow 10:00 pm
weather icon
16° | 18°°C 0.99 mm 99% 13 mph 85 % 1015 mb 0 mm/h
Tue Jul 08 10:00 pm
weather icon
13° | 24°°C 0.2 mm 20% 11 mph 76 % 1020 mb 0 mm/h
Wed Jul 09 10:00 pm
weather icon
15° | 26°°C 0 mm 0% 6 mph 66 % 1023 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
19° | 31°°C 0 mm 0% 8 mph 63 % 1024 mb 0 mm/h
Fri Jul 11 10:00 pm
weather icon
20° | 30°°C 0 mm 0% 12 mph 54 % 1023 mb 0 mm/h
Tomorrow 1:00 am
weather icon
17° | 17°°C 0 mm 0% 9 mph 71 % 1007 mb 0 mm/h
Tomorrow 4:00 am
weather icon
16° | 17°°C 0.31 mm 31% 8 mph 75 % 1007 mb 0 mm/h
Tomorrow 7:00 am
weather icon
14° | 15°°C 0.99 mm 99% 10 mph 85 % 1008 mb 0 mm/h
Tomorrow 10:00 am
weather icon
17° | 17°°C 0.33 mm 33% 12 mph 53 % 1011 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
22° | 22°°C 0 mm 0% 13 mph 37 % 1012 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
20° | 20°°C 0 mm 0% 10 mph 41 % 1013 mb 0 mm/h
Tomorrow 7:00 pm
weather icon
20° | 20°°C 0 mm 0% 7 mph 45 % 1014 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
17° | 17°°C 0 mm 0% 11 mph 49 % 1015 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,832.18
1.06%
Ethereum(ETH)
€2,197.92
2.77%
Tether(USDT)
€0.85
-0.01%
XRP(XRP)
€1.94
2.64%
Solana(SOL)
€129.73
3.54%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.146730
5.10%
Shiba Inu(SHIB)
€0.000010
3.36%
Pepe(PEPE)
€0.000008
5.18%
Scroll to Top