Message From Al jeraisy's HR_Portal March 26, 2026 49488

Malicious QR-phishing email. The attached PDF poses as an updated Al jeraisy HR policy document and instructs the recipient to scan a QR code to access the file. Deep analysis of the PDF extracted a QR code leading to a malicious multistage phishing chain. Browser analysis confirmed the URL impersonates OneDrive and Adobe Acrobat Sign and ultimately abuses Microsoft device login flow device-code flow to harvest access. The sender/addressing is inconsistent with the claimed organization, and the attachment is the primary lure.