Scammers in Russia send QR codes to companies posing as government agencies
Russian company F6 has detected phishing emails demanding payment for 'special delivery' of documents via QR code
In these mailings, attackers impersonate three federal services, using phrases such as 'Control Department' and 'OUT_[agency name]'. The emails are signed by a 'senior inspector' with changing first names and surnames.
The messages mention unscheduled inspections or administrative liability. Details are offered after payment via a QR code, which leads to a fake website. The scammers warn of possible disruptions in Yandex services and advise using Google for the transition.
The goal of the attack is to obtain between 400 and 600 rubles for 'delivery', as well as to collect bank card details, full names, and employees' addresses. This information may be used for further cyberattacks.
The mailings are orchestrated by the cybercriminal QRGos TA, active since autumn 2025. They register domains imitating official government agency websites. Since the beginning of 2026, the attackers have been using themes related to internet issues and Yandex disruptions.
In September-October 2026, the attacks affected companies in five sectors: industry, logistics, construction, retail, and e-commerce. Phishing websites are hosted in domain zones such as .ru, .beer, .biz, .cam, .casa, and others, mimicking the design of delivery services.
F6 recommends not following QR codes from suspicious emails, verifying senders' domains, and cross-checking information with official agency websites.