QR-code business verification phishing lure

QR-code phishing can hide the target URL inside image pixels so static URL rules never see a destination. The detector does not need to decode the QR payload: it requires a QR-like square image plus visible text instructing the recipient to scan or use the QR code for verification, HR, payroll, policy, email, signature, or similar business-process activity. The co-occurrence keeps normal QR codes in brochures or invoices from being flagged on image shape alone.