How are attackers using QR codes in phishing emails and lure documents?

Cisco Talos IR reports a surge in QR code-based phishing, including campaigns that drove victims to fake Microsoft 365 login pages or delivered malware to personal mobile devices, effectively bypassing enterprise protections. The write-up explains how QR lures move the attack surface to less-managed endpoints and offers mitigations such as deploying MDM/mobile security and DNS-layer protection, enabling secure email solutions with QR URL extraction and analysis, enforcing MFA, and strengthening user awareness to spot phishing and suspicious QR codes.