The IT Nerd

A threat actor is engaged in a large scale phishing campaign that is targeted at Questrade customers. The campaign starts with this email:

Now this all looks and sounds official. But it isn’t. When you look at the “Renew Your Form W-8BEN” link, you’ll note this:

While the link says Questrade in it, it clearly isn’t Questrade as the website isn’t going to someplace that Questrade controls. Instead it’s going to a website that the threat actor controls. Now rather than going down the rabbit hole of what is the goal of this campaign, I let Virus Total do it for me:

This appears to be a phishing campaign aimed at stealing your Questrade credentials. Not good. That is confirmed by going to the URL itself. Which by the way, you should never ever do:

This is an excellent replication of the real Questrade website as evidenced here:

It even has the text “Tip: Always double check the URL of log-in pages to keep your account secure” in it. Which if you follow their advice, you can recognize this as a phishing attempt.

I have seen a few dozen of these emails hit my honeypot recently. So this is a large scale phishing campaign. Likely being done by someone who is sending emails out by the thousands hoping to catch 1% of the recipients out and score a big payday as a result. Because scams don’t have to be successful in volume to be successful.

But we’re not done yet, there’s a second Questrade phishing email making the rounds:

The lure is different as it is trying to get you to fall for the scam by getting you to set up 2 factor authentication. But the net result is the same. It is trying to send you to a replication of the Questrade website that will steal your Questrade credentials, and your money along with it.

For the record, if you can use 2 factor or multi factor authentication for your accounts, it would make them way more secure. Questrade has instructions to set that up here.

Here’s the bottom line. If you you get one of these emails, delete it and move on with your life because it is clearly a scam. And a large scale one at that.

This entry was posted on October 29, 2025 at 1:32 pm and is filed under Commentary with tags Scams. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.