Particle.news

Brushing Scam Evolves With Malicious QR Codes in Unsolicited Packages

Regulators issued warnings after discovering that QR codes in brushing packages install malware or harvest user credentials

Overview

  • The new QR codes direct victims to phishing sites or trigger automatic malware downloads when scanned
  • The Federal Trade Commission, Better Business Bureau and U.S. Postal Inspection Service have issued fresh alerts warning consumers not to scan unknown QR codes
  • Amazon and Temu have updated guidance urging customers to report unexpected parcels and avoid engaging with embedded codes
  • Scammers exploit stolen personal data to ship low-cost items and then post fake five-star reviews in victims’ names to boost product ratings
  • Consumer agencies recommend keeping unsolicited goods, refraining from scanning QR codes, changing passwords and monitoring financial accounts for suspicious activity