Suspicious sign-in attempts from QR code phishing campaigns

This detection approach correlates a user accessing an email with image/document attachments and a risky sign-in attempt from non-trusted devices.