QR Code Phishing (Quishing), Izincamathelisi zemitha yokuPaka iFake, kunye nee-URL ezinobungozi¶

Ukuskena ikhowudi yokuPhendula ngokuKhawuleza (i-QR) ngekhamera ye-smartphone yakho ibe ngumkhwa ozenzekelayo wemihla ngemihla wokuhlawula iimitha zokupaka zikamasipala, ukuqalisa izikhululo zokutshaja isithuthi sombane (EV), ukujonga iimenyu zokutyela, ukulandelela ukuhanjiswa kweepasile, kunye nokugqiba uqinisekiso lwezinto ezininzi (MFA). Abadlali boyikiso baxhaphaza oku kuthenjwa kungenziwanga ngokuQuishing (QR Code Phishing): ukuncamathisela iidecals ze-QR zomgunyathi zevinyl ngqo phezu kwezincamathelisi ezisemthethweni kwiindawo zokupaka zikawonke-wonke, ukuthumela amakhadi eposi "obuphosiweyo" bomgunyathi, okanye kufakwe imifanekiso ye-QR eyenziwe ngamandla ngaphakathi kwee-PDF zeshishini ukuze ugqithe kwisango le-imeyile.

Ngenxa yokuba ikhowudi ye-QR iluluhlu lwedatha olufakwe kwi-optically, ekwaziyo ukubamba ukuya kuthi ga kwi-4,296 oonobumba bealphanumeric, iliso lakho alinakuyijonga i-URL yendawo oya kuyo ngaphambi kokukhomba ikhamera yakho kwi-matrix. Okona kubi, ukuskena ikhowudi ye-QR kutshintsha uhlaselo olusuka kwilaptop yakho ejongwe kakhulu ukuya kwi-smartphone yakho, apho iidilesi zebhrawuza eziphathwayo zicutha ii-subdomains ezinde kunye ne-Adversary-in-the-Middle (AiTM) ebuyela umva i-proxies inokubamba ikhadi lakho letyala, i-Apple Pay / Google Pay ithokheni yokubonelela, okanye i-cookie yeseshoni yeMicrosoft 365 ngemizuzwana. Esi sikhokelo sichaza amanyathelo akhawulezileyo okuqulatha okufuneka uwathathe kwimizuzu nje yokuskena ikhowudi ye-QR engalunganga, kuxhomekeke kwinto eyenzekileyo kwisikrini sakho.

Yenza oku ngoku¶

1. Qinisekisa ngoko nangoko ukuba wenze ntoni EMVA kokuskena ikhowudi ye-QR. Ukuvula ngokulula iphepha lewebhu elisemgangathweni kwi-Apple Safari okanye kuGoogle Chrome kwi-iPhone ehlaziyiweyo okanye kwifowuni ye-Android ayifane ifakele i-malware eqhubekayo ngokwayo. Nangona kunjalo, ukuba uchwetheze inombolo yekhadi letyala, ufake i-imeyile/Microsoft 365/password kaGoogle kunye nekhowudi ye-2FA, ** uskene ikhowudi yeQR ngaphakathi kwe-app efakiweyo** (efana neDiscord, WhatsApp, okanye iMicrosoft Authenticator), okanye ifake .apk app okanye .mobileconfig Iprofayile, kufuneka uphumeze isiqulatho ekujoliswe kuso ngoku.
2. Ukuba uchwetheze ikhadi lakho letyala okanye ikhadi ledebhithi kwimitha yokupaka yomgunyathi, indlela erhafelwayo, okanye iwebhusayithi ye-EV tshaja, fowunela inombolo engasemva kwekhadi lakho ngoko nangoko ukuze ucime ikhadi KWAYE ucele i-arhente "Irhoxise zonke ii-Digital Wallet VTS/MDES Network Tokens." Iendawo zokupaka zomgunyathi kunye namaphepha entlawulo yepasile awakuhlawulisi nje iidola ezi-3 zokupaka; baqhuba iskripthi sangemva esibhalisa ikhadi lakho kumhlaseli **I-Apple Pay, iGoogle Pay, okanye i-wallet ye-smartphone ye-Samsung Pay ** usebenzisa i-SMS yokudlula ikhowudi yexesha elinye oyibhale kwiphepha lokuphuma. Ukuba ucela kuphela ibhanki yakho ngekhadi leplastiki elitshintshileyo ngaphandle kokurhoxisa ** Inkonzo ye-Visa Token (VTS) ** okanye ** I-Mastercard Digital Enablement Service (MDES) ** iithokheni ze-wallet yedijithali, i-wallet yefowuni yomhlaseli iya kufumana ngokuzenzekelayo inombolo yekhadi lakho elitsha kwaye uqhubeke uhlawula i-akhawunti yakho.
3. Ukuba ungene kwiMicrosoft 365, iGoogle Workspace, okanye iphepha lokungena ebhankini emva kokuskena ikhowudi yeQR, sebenzisa ikhompyutha ecocekileyo ukutshintsha igama lokugqitha KWAYE ucofe u-"Phuma kuzo zonke iiseshoni / Rhoxisa iithokheni ze-OAuth" ngoko nangoko. Ii-imeyile ze-imeyile eziphumayo zidlula **Evilginx / Modlishka Adversary-in-the-Middle (AiTM) ijikisa i-cookies *i-AiTM ijikise i-cookie usebenzisa i-app yokuqinisekisa. Landela wethu I-MFA phishing kunye ne-Adversary-in-the-Middle bypass khokela kwaye ulumkise inkampani yakho ye-IT Ukhuseleko / iqela le-SOC kwimizuzu emihlanu.
4. **Ukuba uskene ikhowudi ye-QR usebenzisa iskena sekhamera esakhelwe ngaphakathi NGAPHAKATHI kwe-WhatsApp, iDiscord, iTelegram, iSteam, okanye i-WeChat, vula imenyu ye-"Zixhobo eziDityanisiweyo" kwaye ukhuphe zonke iiseshini ezingaziwayo ngokukhawuleza. idinga igama eliyimfihlo okanye ikhowudi ye-2FA.
5. If the QR code prompted you to download an Android .apk ifayile okanye ufake iProfayile yoqwalaselo lwe-iOS (.mobileconfig), faka ifowuni yakho kwiModi yeNqwelo-moya kwaye ususe iprofayili okanye usetyenziso ngokukhawuleza. Khangela ** Useto > Jikelele > VPN & noLawulo lweSixhobo ** kwi-iOS okanye ** Useto > Ukhuseleko > Useto olungakumbi lokhuseleko > Usetyenziso lolawulo lwesixhobo ** kwi-Android, kwaye uqhube uphicotho olupheleleyo lwesixhobo usebenzisa yethu stalkerware, spyware, and keylogger detection on phones isikhokelo.
6. Ukuba ubhaqe isitikha se-QR somgunyathi esibonakalayo kwimitha yokupaka kamasipala, i-transit kiosk, okanye i-EV tshaja, sukujongana naye nabani na ozulazulayo kufutshane. Shenxisela kwindawo ekhuselekileyo, yazisa umsebenzisi wokupaka okanye inombolo yonyanzeliso yesixeko eprintwe kumzimba wesinyithi opeyintiweyo wekiosk, kwaye ukuba ujongene nalo naluphi na ukoyikiswa ngokwasemzimbeni, fowunela inombolo ye-91 kunye ne-1 yaseMelika kwi-United States kaxakeka, kwi-1 yase-United States kwinombolo yakho kaxakeka. 999 eUnited Kingdom, okanye ujonge yethu amanani kaxakeka ulawulo).

Ikhowudi yeQR ekhohlakeleyo (Quishing) umthi wesigqibo sovavanyo lwesiganeko¶

flowchart TD
    Root["Just Scanned a Suspicious or Malicious QR Code"] --> ActionTaken{"What Happened After You Scanned the QR Code?"}

    ActionTaken -->|"1. Iphepha leWebhu elivuliweyo kuphela: iTab evaliweyo ngaphandle kokuchwetheza nantoni na okanye ukukhuphela umthwalo"| SafeClean["Umngcipheko ophantsi: Vala ithebhu yesikhangeli -> Sula idatha yesayithi/icookies zeso sizinda -> Jonga ifolda yokukhuphela -> Qinisekisa i-iOS/Android OS isexesheni"]

    ActionTaken -->|"2. Ufake iKhadi leThredithi/Debit kwimitha yokuPaka iFake, itshaja ye-EV, okanye iPhepha lePasile"| CardComp["1. Call Bank Fraud Dept immediately to lock & replace card<br/>2. CRITICAL: Demand revocation of all Apple Pay / Google Pay Digital Wallet Tokens (VTS/MDES)<br/>3. Check if your car is actually unpaid at the meter to avoid getting towed"]

    ActionTaken -->|"3. Ngena kwiPassword yoMsebenzi/I-imeyile + 2FA Code (Microsoft 365, Google, Okta)"| CredComp["1. Cinga ukuba i-AiTM Session Cookie Theft (Evilginx)<br/>2. KwiPC ecocekileyo, tshintsha igama lokugqitha uze ucofe u-'Phuma kuzo zonke iiSeshini'<br/>3. Cima izixhobo ezikhohlakeleyo ze-MFA & nemithetho yokuthunyelwa kwe-inbox<br/>4. Yazisa Corporate IT SOC ngoko nangoko"]

    ActionTaken -->|"4. Ikhowudi ye-QR eskeniweyo usebenzisa i-In-App Scanner (WhatsApp, Discord, Telegram, Steam)"| SocketHijack["Vula Useto lwe-App -> 'Izixhobo eziQhagamshelweyo' / 'Izixhobo eziGunyazisiweyo' -> Ziphelise ngoko nangoko zonke iiSeshini zeWebhu/Desktop ezingaziwayo"]

    ActionTaken -->|"5. Kuhlohlwe i-App (.apk), iProfayile yoLungiselelo lwe-iOS, okanye Cofa u-'Vumela' kwi-Prompts"| MalwareCheck["1. Vula imo yenqwelomoya ngoko nangoko<br/>2. iOS: Useto> Ngokubanzi> VPN kunye noLawulo lweSixhobo -> Cima iprofayile engaziwayo<br/>3. I-Android: Khipha i-APK ekhohlakeleyo kwaye urhoxise ukuFikelela / iimvume zolawulo"]

Ukuqonda i-5 eyahlukileyo yohlaselo lobugcisa be-vectors emva kweekhowudi ze-QR¶

Ikhowudi ye-QR (i-ISO/IEC 18004 esemgangathweni) ayivuli kuphela https:// iiwebhusayithi. Kuxhomekeka kwisikimu se-URI esifakwe ngaphakathi kwiimodyuli ezimnyama-namhlophe, ukuskena ikhowudi kunokubangela izenzo ezintlanu ezahlukeneyo ngokupheleleyo kwi-smartphone yakho:

Scenario A: You scanned a fake QR sticker on a parking meter, EV charger, or toll notice and entered payment details¶

Physical QR overlay tampering has surged across cities in North America, Europe, the United Kingdom, and Australia. Because victims are usually standing on a busy sidewalk in a hurry, they rarely notice that a glossy vinyl sticker has been pasted over the painted metal meter face.

Step-by-step financial and vehicle containment¶

1. Lock the compromised card and purge Digital Wallet Provisioning Tokens (VTS / MDES):
2. Open your banking mobile app immediately and toggle Lock / Freeze Card to ON.
3. Call the fraud number on the back of your card and ask for the Digital Wallet / Tokenization Fraud Desk.
4. Why standard card replacement fails: If you entered a 6-digit SMS code or email code on the fake parking page after typing your card number, you inadvertently authorized the attacker to link your card to their Apple Pay, Google Pay, Garmin Pay, or Fitbit Pay account. Ask the bank representative to:
   1. View all Active Digital Wallet / Device Tokens linked to your Primary Account Number (PAN).
   2. Delete/Terminate all unrecognized Apple Pay, Google Pay, and merchant tokens.
   3. Opt out of Visa Account Updater (VAU) / Mastercard Automatic Billing Updater (ABU) for this re-issuance so the new card number is not automatically forwarded to recurring fraudsters.
5. Pay your parking session legitimately right now so your vehicle is not ticketed, booted, or towed:
6. Remember: Because the QR sticker belonged to a criminal and not the city parking authority, your license plate is currently parked unpaid.
7. Never scan any sticker on the machine. Instead, walk to the meter and pay with a physical coin/contactless tap directly on the hardware terminal, or go to the official Apple App Store / Google Play Store, download the verified municipal app (such as ParkMobile, PayByPhone, RingGo, EasyPark, or PayStay), and type the 4-to-6-digit Zone Number painted on the metal pole.
8. Photograph the counterfeit sticker before reporting it:
9. Take a clear photograph of the parking meter or EV charger showing both the counterfeit QR sticker (look for raised adhesive edges, mismatched font sizes, or a sticker covering part of the official logo) and the meter serial/pole number.
10. Call the municipal parking authority or EV charging network (ChargePoint, Electrify America, EVgo, Ionity, Shell Recharge) customer service phone number printed on the kiosk so maintenance crews can scrape off the overlay stickers along the entire street block.

Scenario B: You scanned a QR code in a work email or PDF and entered your Microsoft 365, Google, or Okta login¶

In corporate cybersecurity, QR code phishing is the #1 delivery mechanism for Adversary-in-the-Middle (AiTM) session hijacking. Because most employees read work emails on their desktop monitor and pick up their personal smartphone to scan the QR code on the screen, the login happens over the employee's cellular 5G connection, completely bypassing the corporate laptop's Endpoint Detection and Response (EDR) agent, corporate firewall, and browser phishing extension.

Immediate 15-minute account containment protocol¶

1. Do NOT assume your Authenticator App protected you:
2. Modern quishing pages use Evilginx, Modlishka, or Muraena reverse proxies. When you type your corporate email, password, and 6-digit Authenticator code (or approve an Authenticator Push / number match) on the fake mobile page, the attacker's server relays your credentials to login.microsoftonline.com in real time and captures the resulting ESTSAUTH / ESTSAUTHPERSISTENT session cookie.
3. On a clean computer, rotate your password AND revoke all active session tokens:
4. Microsoft 365 / Entra ID: Go to https://mysignins.microsoft.com/security-info. First, click Sign out everywhere (to invalidate the stolen session cookie). Second, change your password. Third, look carefully at the list of Sign-in methods on that exact page, attackers use automated scripts that register their own rogue Authenticator App or FIDO2 key onto your account within 8 seconds of stealing your cookie. Delete any Authenticator device you do not recognize.
5. Google Workspace / Gmail: Go to https://myaccount.google.com/device-activity, click the unrecognized mobile/Linux session -> Sign out, change your password, and verify 2-Step Verification devices.
6. Check your email inbox for silent "Rule / Forwarding" persistence:
7. Attackers who hijack a corporate mailbox via a QR code immediately create a hidden Inbox Rule in Outlook Web (Settings > Mail > Rules kwaye Forwarding) that routes every incoming email containing words like "Invoice", "Wire", "Payment", "ACH", okanye "DocuSign" into the RSS Subscriptions or Archive folder while marking it as read. Audit and delete all unknown rules using our email account hacked, forwarding rules, and recovery isikhokelo.
8. Notify your corporate IT Help Desk or Security Operations Center (SOC) immediately:
9. Never hide an accidental QR scan at work out of embarrassment. Calling IT within 5 minutes allows an administrator to click "Revoke sessions" and "Require re-register MFA" in Entra ID / Okta before the attacker can launch a Business Email Compromise (BEC) wire fraud attack against your clients.

Scenario C: You scanned a QR code using an In-App Scanner (WhatsApp, Discord, Telegram, Steam)¶

If a friend, gaming server "Verification Bot," or fake giveaway page told you to "Open Discord / WhatsApp / Steam -> Open QR Scanner -> Scan this code to claim a reward or verify your age", you did not visit a website, you just authorized a Remote Desktop / Web Client Login (QRLJacking):

• WhatsApp: Immediately open WhatsApp on your phone -> tap Settings (or the three dots ⋮ on Android) -> tap Linked Devices -> tap every listed Google Chrome (Windows/Linux/Mac) or unknown session -> tap Log Out.
• Discord: Immediately open Discord -> tap Settings -> Devices -> Log Out All Known Devices, and change your Discord password (changing your Discord password automatically invalidates the stolen Authorization token in the attacker's browser).
• Telegram: Open Telegram -> Settings > Devices -> Terminate All Other Sessions.
• Steam: Open the Steam Mobile App -> tap the Shield icon (Steam Guard) -> Gear icon -> Authorized Devices -> Remove access from any unrecognized PC.

Scenario D: You only scanned the QR code and opened the webpage (Didn't type anything)¶

If you pointed your iPhone or Android camera at a suspicious QR code, tapped the yellow URL banner, saw a sketchy webpage load in Safari or Chrome, and immediately closed it without typing any passwords, credit cards, or clicking "Install":

1. Take a deep breath: A zero-click drive-by browser exploit from a street parking sticker is extraordinarily rare. Commercial zero-click mobile browser exploits cost millions of dollars and are reserved by nation-state intelligence agencies for targeted espionage, not mass parking-meter scams.
2. Close the browser tab and purge site storage:
3. iOS (Safari): Close the tab, then open Settings > Apps > Safari > Advanced > Website Data, search for the suspicious domain name, and swipe left to Delete its cookies and cache.
4. Android (Chrome): Tap the padlock / tune icon to the left of the address bar -> Cookies and site data -> Delete (or go to Settings > Privacy and security > Delete browsing data -> Last hour).
5. Check that your browser did not silently enable push notification spam or download a file:
6. In Android Chrome, go to Settings > Site settings > Notifications and verify no strange website was granted permission to send you fake "Virus Detected" push notification pop-ups.
7. Open the Files / Downloads folder on your phone and delete any .apk, .pdf, .ics (calendar spam), or .mobileconfig file that downloaded automatically when the page loaded.
8. Verify no GSM Call Forwarding was triggered (if the QR code opened your Phone Dialer):
9. Open your phone keypad and dial *#21# (checks unconditional call forwarding status). If any number is listed, dial ##002# and press Call to wipe all GSM call-forwarding rules on your carrier line.

Scenario E: Counterfeit Cryptocurrency Hardware Wallet QR Codes and Fake "AirDrop / Claim" Stickers¶

Another rapidly growing Quishing vector targets cryptocurrency owners through physical mailers and tampered packaging:

1. Tampered Ledger / Trezor / Coldcard Packaging Inserts:
2. Fraudsters buy hardware wallets, insert a laminated counterfeit instruction card containing a QR code reading "Scan to run mandatory Firmware Integrity Check or initialize your 24-word recovery seed", shrink-wrap the box, and return it to third-party retail marketplaces.
3. Golden Rule: Legitimate hardware wallets never ask you to type your 12-word or 24-word BIP-39 recovery phrase into a smartphone web page or scan a QR code that asks for your seed words. If you entered your seed phrase after scanning a QR code, your wallet is already monitored by an automated sweeper bot; execute our cryptocurrency wallet drain and seed phrase compromise protocol immediately.
4. WalletConnect (wc:) Malicious DApp Drainer QR Codes:
5. Scanning a wc: QR code from inside MetaMask, Phantom, Rabby, or Trust Wallet connects your Web3 wallet to a third-party decentralized application (DApp). If the site immediately pops up a signature request (Permit2, setApprovalForAll, okanye increaseAllowance), click Reject and disconnect the WalletConnect session under Settings > Connected Sites / WalletConnect Sessions.

Forensics: How to safely decode and inspect a suspicious QR code image without scanning it with your phone¶

If you received a suspicious PDF or email containing a QR code and want to see where it leads without touching it with your smartphone, use these safe command-line or sandboxed methods on a desktop computer:

# 1. Decode the raw text/URL inside a QR code image offline using 'zbarimg' (Linux/macOS):
# (Does NOT connect to the internet; simply prints the decoded string to your terminal)
zbarimg --raw suspicious_qr_image.png

# 2. Trace all HTTP 301/302 redirect hops without executing JavaScript or loading the page:
curl -sIL --max-redirs 10 "https://suspicious-short-url.example/xyz" | grep -iE "^(HTTP/|location:)"

# 3. Inspect DNS registration age (Quishing domains are almost always <14 days old):
whois suspicious-parking-domain.com | grep -iE "Creation Date|Registrar:"

Reporting physical and digital Quishing attacks to official authorities¶

Reporting a malicious QR code gets both the physical sticker removed by city crews and the underlying phishing domain sinkholed by global browser blocklists (Google Safe Browsing and Microsoft SmartScreen):

1. Report the malicious URL to Google Safe Browsing & Cloudflare Radar: Submit the decoded URL to safebrowsing.google.com/safebrowsing/report_phish/ kwaye radar.cloudflare.com/scan. Once flagged, every iPhone Safari and Android Chrome browser worldwide will display a full-screen red "Deceptive Site Ahead" warning within 15 to 30 minutes whenever the next pedestrian scans that parking meter sticker.
2. File an official cybercrime report:
3. EUnited States: Fayila ingxelo kwiZiko leZikhalazo zoLwaphulo-mthetho kwi-Intanethi yeFBI (ic3.gov) kunye ne-Federal Trade Commission (reportfraud.ftc.gov), kwaye wazise ugunyaziwe wokupaka wesixeko sakho sasekhaya.
4. United Kingdom: Dlulisela phambili ii-imeyile ezicelwayo ku-report@phishing.gov.uk (iZiko leSizwe loKhuseleko lweCyber) kunye nengxelo yelahleko yemali ku Ubuqhophololo beZenzo (actionfraud.police.uk).
5. ** I-European Union, iKhanada, kunye ne-Australia **: Ingxelo kwi-*Canadian Anti-Fraud Centre (antifraudcentre-centreantifraude.ca)**, Scamwatch yaseOstreliya (scamwatch.gov.au), okanye iqela lakho lesizwe leempendulo zikaxakeka zekhompyutha (CERT).

Uyihlola njani nayiphi na ikhowudi ye-QR ngokukhuselekileyo NGAPHAMBI kokundwendwela i-URL (Uluhlu loThintelo loThintelo)¶

You never have to guess where a QR code leads. Follow these five rules every time you encounter a QR code in public or by mail:

• Sebenzisa uzipho lwakho kwiikhowudi ze-QR ezibonakalayo kwiimitha zokupaka, iitshaja ze-EV, kunye neetafile zokutyela: Ikhiyoski yokupaka esemthethweni kunye ne-EV tshaja iikhowudi ze-QR mhlawumbi ikhuselwe ngesilika ngqo kwipleyiti yobuso bentsimbi okanye itywinwe ngaphantsi kwephepha elicacileyo le-polycarbonate. Ukuba uzipho lwakho lubambe isiphelo esiphakamileyo sephepha okanye isincamathelisi sevinyl esincanyatheliswe phezu kophawu, ungaze usiskene.
• **Funda umboniso opheleleyo we-URL kwi-app yakho yekhamera kwaye ungahoyi izishunquleli ze-URL **: Zombini i-app eyakhelwe ngaphakathi ye-iOS yeKhamera kunye nekhamera ye-Android zibonakalisa ibhena yepilisi encinci ebonisa igama lesizinda phambi kokuvula isikhangeli. Ukuba imitha yokupaka kamasipala okanye isaziso sebhanki sibonisa i-URL efinyeziweyo okanye eqhelekileyo (bit.ly, tinyurl.com, qrco.de, t.co, lnkd.in, okanye page.link), ** ungayithephu **, ii-arhente zikarhulumente kunye neebhanki ezinkulu azize zisebenzise izifinyezo zekhonkco lomntu wesithathu kwii-kiosks zokuhlawula.
• Vala "Vula uQhagamshelwano Ngokuzenzekela" kwiisetingi zekhamera yefowuni yakho: Qinisekisa ukuba usetyenziso lwekhamera yakho lufuna ukuba ufunde ngesandla kwaye ucofe isibhengezo se-URL yokujonga kwangaphambili kunokumisela isikhangeli ngoko nangoko ikhowudi ye-QR ingena kwisakhelo.
• Ungaze uskene ikhowudi ye-QR efika ngaphakathi kweleta okanye ikhadi leposi elingacelwanga ("USPS / Royal Mail / Amazon Mystery Package"): Abaqhathi bathumela iipakethe eziphathekayo eziqulethe into exabiso liphantsi, engacwangciswanga (njengeringi yeplastiki okanye itshaja yefowuni, "iBrushing Scam") ehamba nekhadi elifundwayo *"Skena le khowudi ye-QR ukubona ukuba ngubani okuthumeleyo le khowudi ye-QR okanye ukhuphele i-trash yesipho sakho.
• ** Khuphela ukupaka kunye ne-EV yokutshaja ii-apps ngokuthe ngqo kwi-App Store / i-Play Store *: Endaweni yokuskena ikhowudi ye-QR yesitalato, vula i-app ye-ParkMobile, i-PayByPhone, i-RingGo, okanye i-ChargePoint kwaye uchwetheze i-Inombolo yeZone eprintiweyo kuphawu.

Imibuzo edla ngokubuzwa¶