Russian Phishing Drones Target Kyiv With Malware QR-Codes in Pro-Ukraine Pamphlets

A new Russian drone loaded with propaganda leaflets containing QR-Codes designed to give away a finder’s location and identity by phishing was shot down by a Ukrainian anti-drone unit, a Wednesday statement published by Ukraine’s Unmanned Systems Forces (USF) said. The aircraft, an Iran-designed push-propeller Shahed drone, struck ground near positions occupied by the 427th Special Forces Battalion on a flight approach route to the capital Kyiv.JOIN US ON TELEGRAMFollow our coverage of the war on the @Kyivpost_official. Soldiers inspecting the crash site found the Shahed was stuffed with single-page flyers with pro-Russia content and false information printed on them, each with a scannable QR code designed to pass on to Russian intelligence services the finder’s location and personal information, the statement said. Material published by the finding unit 427 Battalion “Rarog,” also on Wednesday, confirmed the USF report and Russian use of phishing tactics by drone. Video of a foot patrol to the crash site showed dozens of launch containers each stuffed with paper materials that, by design, would have scattered contents for Ukrainian civilians to read before the drone flew in to impact its target. The drone’s warhead failed to explode, but a fuel fire damaged the drone and its payload partially, images showed. Per the report, some of the single-color printed content found inside the fuselage claimed - falsely that Russia’s armed forces had stood up a volunteer unit manned by Ukrainians, and suggested the pamphlet reader “vote” for the best name for that formation via a QR-code scan. Other Topics of Interest Russia to Supply Iran With 90 Helicopter-Mounted Missile Launchers Used in Ukraine War The military partnership between Moscow and Tehran has expanded significantly since Russia launched its full-scale invasion of Ukraine in February 2022. Choices evoked historical figures believed in Ukraine to be national heroes that fought for independence, and which, in Russia, are considered seditious criminals. Among the naming options was Ukrainian partisan commander Nestor Makhno, a fighter against Soviet rule in the 1920s, Cossack Hetman Bohdan Khmelnitsky, leader of a revolt against Polish and Lithuanian rule in the 1640s, and Grand Prince Volodymyr Monomakh, the early 12th-century founder of the first Ukrainian state. Other papers showed photographs of men dressed in Ukrainian police uniforms or military uniforms, detaining civilian men and using force to push the detainees into a van. A person objecting to street conscription of combat soldiers by the Ukrainian government – a relatively rare occurrence heavily played up in Russian state media – might scan the QR code next to the photographs to learn more information to avoid being dragooned into the Ukrainian military, that paper said. Links generated by both materials lead to Russia intelligence-associated websites that collect information for Russia’s armed forces and should not be activated, the USF statement said. Ukrainian forces first announced detection of Russian use of malicious QR codes delivered by drone in early 2025, initially by single-page leaflets offering food or material assistance to civilians living near or at front line positions. Google’s Threat Intelligence Group in February 2025 documented a Russian campaign targeting Ukrainian military personnel with malicious QR codes disguised as Signal group invitations; if scanned, the user’s Signal account was compromised, giving Russian operators intelligence access to subsequent messages. In September 2025, Russian drones dropped counterfeit 100-hryvnia banknotes in Chernihiv, disguised as genuine currency, along with leaflets and QR codes calling on finders to pass on to Russian forces the location of Ukrainian troops and fighting positions, in exchange for money. In early April 2026, law enforcers and civilians found similar fake bank notes with QR codes scattered in rural regions of Ukraine’s northern Chernihiv and Sumy regions. A list of possible names for a fake Ukrainian volunteer unit fighting on the side of Russia is visible, along with suggested names for the formation, in a propaganda flyer found in a crashed Russian drone north of Kyiv on Tuesday. A QR code, according to the paper, allows a finder to “vote” for a name of the non-existent unit. According to Ukraine’s unmanned systems forces’ statements, the code in fact sends a scanner’s location and personal data to Russian intelligence. The QR code is visible at the bottom-left, pixelated. (Photograph published by 427 Special Operations Battalion “Rarog” on Wednesday) Stefan Korshak is the Kyiv Post Senior Defense Correspondent. He is from Houston Texas, is a Yalie and since the mid-1990s has worked as correspondent/photographer for newswire, newspapers, television and radio. He has reported from five wars but most enjoys doing articles on wildlife and nature. You can read his weekly blog on the Russo-Ukraine War on Facebook, Substack and Medium. His new book on the 2022 Siege of Mariupol is available on Amazon UK and Amazon US.