The Payroll Trap: New Quishing Campaign Uses Fake CAPTCHAs to Hijack Employee Paychecks

A sophisticated new phishing campaign is targeting employees where they are most vulnerable—their paychecks—by leveraging QR codes to bypass corporate security defenses. A new analysis by CYFIRMA details a highly targeted “quishing” (QR code phishing) operation that uses fake payroll notifications to lure victims out of the safety of their secure office networks and onto their unprotected personal mobile devices.

The campaign marks a disturbing evolution in social engineering, moving away from “spray and pray” tactics toward highly specific, context-aware attacks. As the report notes, “The campaign demonstrates a high level of operational sophistication, emphasizing the shift toward targeted, industry-specific threats”.

The attack begins with a convincing email masquerading as a payroll update or compensation adjustment. To bypass standard email security gateways that scan for malicious links, the attackers embed a QR code instead of a clickable URL.

When an employee scans the code with their smartphone, the attack achieves a critical strategic goal: it moves the victim off the monitored corporate network.

“By prompting users to scan QR codes rather than click links, attackers effectively shift the attack surface away from monitored corporate environments and onto employees’ personal mobile devices, where security visibility and controls are often limited or absent”.

Once the victim is redirected to the malicious site, they are greeted not by a login screen, but by a fake CAPTCHA prompt. This is not designed to stop bots, but to fool humans and security scanners alike.

According to CYFIRMA, “The phishing infrastructure is purpose-built to evade traditional defensive mechanisms”.

The fake CAPTCHA serves a dual purpose: it builds trust with the user and buys time for the malicious script to execute in the background. “The script extracts the victim’s email address and auto-fills it into the password entry form, reinforcing the illusion of legitimacy and increasing the likelihood of credential submission”.

The sophistication of the backend infrastructure—which uses rotating subdomains and unique URL paths for each victim—complicates forensic investigation and highlights the professional nature of the attackers.

The report concludes with a stark warning for organizations: “Overall, this campaign reflects a broader shift toward highly customized, multi-stage phishing operations that blend technical sophistication with psychological manipulation”.

As employees increasingly rely on mobile devices for work, security teams must adapt their defenses to protect against threats that essentially walk right past the firewall in the user’s pocket.

Related Posts:

• Payroll Pirates: Unveiling the Sophisticated Payroll Redirection Phishing Campaign
• The Rise of Quishing: QR Codes as a Gateway to Phishing Attacks
• Beware the Invisible Threat: Phishing Expands with QR Codes, CAPTCHAs, and Steganography
• Payroll Piracy: Hackers Storm-2657 Exploit MFA Flaws to Hijack University Salary Payments via Workday
• QR Codes Coming to Linux Kernel Panics with 6.12 Release