Unsolicited Packages, Hidden Threats

Unsolicited Packages, Hidden Threats: Brushing Scams Evolve Into Weaponized Attacks

An increasingly disturbing form of cybercrime is gaining traction across the U.S., merging the old-world tactic of unsolicited “brushing” packages with modern digital deception.

Once considered a quirky annoyance, brushing scams involved merchants sending low-value items—rubber chickens, novelty toys, knock-off electronics—to strangers in order to falsely inflate online reviews. The packages often arrived with the recipient’s name, address, and even phone number, despite no order being placed. While strange, these incidents were generally considered harmless.

That’s no longer the case.

Recent reports from the FBI and the U.S. Postal Service now warn of a darker evolution of the tactic. A growing number of these packages include QR codes—innocuous on the surface but weaponized beneath.

How It Works:

• Recipients receive an unexpected package with their correct contact information.

• A QR code is included—printed on an insert, stickered to the item, or part of a fake warranty or survey offer.

• Once scanned, the QR code leads to:
  

  • Phishing sites designed to harvest personal credentials and banking data

  • Malware payloads that infect mobile devices and exfiltrate data silently

  • Surveys or contests that act as social engineering traps to gather sensitive information

Security experts say this marks a significant evolution in hybrid attacks—where physical social engineering intersects with digital exploitation. It also raises deeper concerns about how easily threat actors can access or purchase consumer information from data brokers, enabling them to create extremely believable delivery scams.

What You Should Do:

• Never scan QR codes from unknown or unsolicited packages.

• Report suspicious deliveries to the USPS Inspector General or your local law enforcement.

• Monitor your credit and bank accounts if you believe your information may have been compromised.

• Consider placing a freeze on your credit file with major bureaus if strange deliveries continue.

Law enforcement officials are still investigating the origin of these campaigns, with some believed to be linked to state-sponsored or international cybercrime rings.

This is no longer about free merchandise. It’s about infiltration, exploitation, and deception—delivered in an Amazon-sized box.

The real question is:

When that next package arrives… will you scan it?