Quishing event invitation with poster image and QR registration lure
Detects incoming emails containing QR code references in the body along with registration/invitation subjects and common document or image attachments, where the QR code URL is either missing (undecoded) or points to domains other than Google Forms, potentially indicating a phishing attempt attempting to bypass standard URL inspection.
Splunk (SPL)
