QR phishing attack on a US MSP: the fake MFA-reactivation email (2023)

Hornetsecurity's write-up does not describe specific recon tradecraft used against this MSP, but campaigns of this type typically involve identifying a target organization and picking a specific employee, likely favoring an MSP because a single compromised account can offer a plausible pivot point into every downstream client tenant the MSP manages.

the attackers registered a domain Hornetsecurity verified was very recently created to host the final Microsoft 365 spoof, staged a separate .ru-hosted fake 'security scan' interstitial that reused attributes and behaviors from a prior campaign Hornetsecurity had already reported, and fronted that interstitial with Cloudflare specifically to gain its antibot protections and slow down vendor or analyst investigation.

the attackers built a support-ticket-styled email using genuine Microsoft and Microsoft Authenticator branding, an MFA-deactivation urgency message, a sender display name spoofed to the target MSP's own name, and a QR code (rather than a text link) as the only call-to-action, a combination designed to look official and to evade filters that scan URLs or text rather than images.

the email was sent to a single employee at the target MSP and bypassed Microsoft 365's native security filtering, per Hornetsecurity's detection of the campaign.

the email instructed the recipient to scan the embedded QR code with a smartphone; Hornetsecurity's write-up traces where the code leads but does not confirm the employee actually scanned it, so this step describes the intended, not confirmed, victim action.

if scanned and tapped through, the code would lead to the .ru-hosted page simulating an antivirus/security scan and then showing a green 'Success' checkmark, a fabricated trust signal meant to lower suspicion before the real payload page loads.

the chain's final destination was the spoofed, freshly registered Microsoft 365 login page, designed to capture a username and password; Hornetsecurity describes this only as the page's 'likely' purpose and does not confirm the employee ever reached or interacted with it.

captured M365 credentials would, if the chain were completed, grant initial access to the employee's account and, per Hornetsecurity, could enable data exfiltration, malware spread, or vendor email compromise reaching downstream MSP clients, though the write-up stops short of confirming any of this occurred.