The Fake HR Report That Couldn't Name Its Own Employee

A targeted quishing campaign delivered a PDF impersonating internal HR attendance to multiple recipients at an airline-catering company; the PDF used the recipient's email address in place of a name, contained a QR code linking to an unrelated German domain, and scored clean on attachment/link reputation, but was reported and removed by an employee. Indicators (sender, IP, attachment hash, URL) and detection guidance (detect personalization by email address) are provided.