Finance Firm — 2026-Jul-30

2026-Jul-30 Finance Firm

Detect, investigate, and contain a QR-code phishing ("quishing") campaign impersonating an internal notice — removing every copy from the client's mailboxes and blocking the sources within a day.

Scoped the campaign from a staff report and traced it as the latest in a short related series using the same toolkit, isolating it with a distinctive sender fingerprint
Investigated through the client's cloud SIEM and endpoint detection following our own post-incident procedure, verifying no account compromise or data loss
Removed all remaining message copies from mailboxes, completing what automated cleanup had left, and confirmed none remained
Blocked every sending source, deployed a sender-fingerprint filter that would have caught the whole series, and reinforced staff awareness on reporting and not scanning unexpected QR codes

Related projects

2026-Aug-12· Finance Firm Design and stand up a major, bilingual, fully managed cloud security operations center on Microsoft Sentinel, connecting the client's Microsoft and firewall… View details →
2026-Aug-12· Finance Firm Build, harden, and operate a major telemetry pipeline that streams AI-tool usage and firewall security events into a cloud SIEM, delivered across two phases… View details →
2026-Jul-16· Finance Firm Review a client's completed counterparty cybersecurity self-assessment before submission, validating responses and ensuring the managed security controls we… View details →
2026-Jul-14· Finance Firm Remediate actively-exploited critical firewall vulnerabilities under urgency: apply interim protection, verify no compromise, and complete a coordinated remote… View details →