The Payroll Trap: New Quishing Campaign Uses Fake CAPTCHAs to Hijack Employee Paychecks

A sophisticated new phishing campaign is targeting employees’ paychecks by using QR codes to bypass corporate defences, according to a CYFIRMA analysis released on 23 December 2025. The operation, described as a highly targeted “quishing” campaign, uses fake payroll notifications to lure victims from secure office networks to their personal mobile devices.

The attackers send an email masquerading as a payroll update, and instead of a clickable URL, the user is prompted to scan a QR code, moving the victim off monitored networks.

Once on the malicious site, victims encounter a fake CAPTCHA prompt; according to CYFIRMA, “The phishing infrastructure is purpose-built to evade traditional defensive mechanisms.” The fraud unfolds as the script extracts the victim’s email address and auto-fills it into the password field, reinforcing the illusion of legitimacy and increasing the likelihood of credential submission, with rotating subdomains and unique URL paths complicating forensic investigation.