Research Findings
QR phishing campaigns exploit a measurement gap as much as a technical one. Email tools may observe delivery, but the actual interaction often shifts to a mobile camera, unmanaged browser, or personal device where enterprise telemetry is thinner.
Analysis Interpretation
Counting how many QR lures arrived does not show whether users scanned, whether the destination was blocked, or how quickly a report reached the SOC. More useful metrics connect message attributes, scan opportunities, landing-page availability, and reporting outcomes.
Operational Pattern
Teams should test QR lures against mail controls, browser protections, mobile device coverage, and reporting workflows. The goal is to identify where visibility drops, then add detection or user guidance at the exact transition point.