Since May 2023, a large phishing campaign is utilizing Quick Response (QR) codes in an attempt to collect Microsoft credentials from victims. The emails masquerade as a Microsoft security notification with a QR code embedded inside a PNG image or a PDF attachment.