The Payroll Memo Whose Link You Could Not Scan: QR Code Quishing Buried in a Word Attachment

An attacker sent a personalized payroll memo DOCX with an embedded PNG QR code that resolved to a credential-harvesting URL on an obscure TLD; because the link was an image inside the attachment and intended to be scanned on a personal phone, inline URL scanners and corporate web proxies never inspected it. Authentication (SPF/DKIM/DMARC) failed but the lure used the recipient's real name and email to build trust; the report includes defanged IoCs (domain, URL fragment pattern, originating IP, attachment filename and MD5) and recommends decoding QR images inside documents, adding behavioral/contextual detection, and user training.