The QR Link With No QR Code in a Calm Telecom Bill Lure

A calm-looking phishing email impersonating Pelephone sent to an Israeli real-estate employee used a commercial dynamic QR short link (no QR code) as an editable redirector; all visible links pointed to that short link, which redirected to a cloned carrier page that displayed a modal threatening service suspension unless the account was paid. The report provides indicators (short-link paths, landing page path with 'Israsel' misspelling, sending IP 157.7.100.20, date-stamped subject), maps techniques to MITRE ATT&CK, and recommends resolving short links at delivery/click and checking anchor text vs href.