Zug QR-code scams spotlight 146% global rise in quishing attacks

Authorities in Zug, Switzerland uncovered fake QR‑code stickers on parking‑meter kiosks that redirected users to fraudulent payment sites, exposing drivers to credential theft. The incident comes amid a sharp increase in QR‑code phishing, known as "quishing," which the Zimperium Mobile Phishing Report 2024 says grew 146% year‑over‑year, with Japan and the United States accounting for the largest shares of attacks.

Security experts warned that the QR‑code’s target URL is often hidden at the moment of scanning, making it easy for criminals to exploit. They recommend users verify URLs, rely on official payment apps, and report suspicious stickers immediately.

Researchers also highlighted a surge in sophisticated banking malware, including the Hook v3 and RedHook trojans capable of up to 107 remote commands and NFC‑overlay attacks that compromise contactless payments. An Android 16 vulnerability further enables malicious messaging even on locked devices.

Separately, a deep‑fake fraud in Mumbai resulted in the theft of €11.5 million across 63 transactions, illustrating how AI‑generated media can facilitate large‑scale financial crime.