The PDF Was a Decoy. The QR Code Was the Weapon.

In March 2026 a targeted 'quishing' attack delivered a PDF with an embedded QR code that decoded to a personalized phishing URL (with the recipient's email encoded in the fragment) used to harvest credentials; the sender domain failed SPF/DKIM/DMARC and the landing site was fronted by Cloudflare, but behavioral AI quarantined the message within six minutes. The report provides IOCs (sender domain concretejsl.com, landing domain userfocusedtech.de, sending IP 104.168.56.196, PDF MD5 4c61313575a456669695711353bb03f5), maps the technique to relevant ATT&CK techniques, and recommends adding QR extraction in attachment analysis, weighting authentication failures more heavily, and using behavioral detection.