New phishing campaign with QR codes: how Microsoft Sway became a tool for stealing your credentials

Researchers in the field of cybersecurity are reporting a new phishing campaign using QR codes that employs the Microsoft Sway platform to host fake pages. This once again highlights how attackers can exploit legitimate cloud services for their purposes.

The use of legitimate cloud applications like Microsoft Sway lends credibility to the content, which helps attackers deceive users. When a victim opens a Sway page, they are already logged into their Microsoft 365 account, further convincing them of the page's legitimacy. Sway can be shared via a link or embedded in a webpage using an iframe. The attacks are primarily aimed at users in Asia and North America, particularly in the technology, manufacturing, and finance sectors. Microsoft Sway is a cloud tool for creating newsletters, presentations, and documentation. It has been part of the Microsoft 365 product family since 2015.

Since July 2024, there has been a 2000-fold increase in traffic to unique phishing pages on Microsoft Sway, with the ultimate goal of stealing Microsoft 365 credentials. This is done using fake QR codes hosted on Sway, which redirect users to phishing sites when scanned. Some campaigns use Cloudflare Turnstile to bypass static URL analysis systems. Attackers also employ "man-in-the-middle" (AitM) tactics, using fake login pages to steal credentials and two-factor authentication codes.

The use of QR codes to redirect to phishing sites puts defenders in a difficult position, as the URL is hidden within the image. When a user receives a QR code, they may use another device, such as a mobile phone, to scan it, making them more vulnerable. Phishing attacks using Microsoft Sway are not new. In April 2020, a campaign called PerSwaysion successfully compromised the corporate email accounts of 156 high-ranking employees from various countries.

As security vendors develop countermeasures, phishing campaigns are becoming increasingly sophisticated. For example, a new phishing technique involves creating QR codes using Unicode characters instead of images, which poses a significant challenge for detection by traditional methods.

Unicode QR codes bypass detection systems that scan for suspicious images, as they consist entirely of text characters and can display correctly on screens. This makes them particularly dangerous and complicates detection efforts.