QR code phish in restaurant invoices
A 32-person hospitality group received PDF invoices from a "vendor" with a QR code instead of a payment link. Scanning routed the AP clerk's phone to a credential-harvest page outside the corporate firewall — bypassing every email and endpoint control on the desktop.
Vector
QR · PDF · Mobile
Target
Finance / AP
Defense
Verify on a known device