That was the attack surface.

You just trusted a QR code because it appeared inside a trusted presentation.

In a real attack, the destination could have been a counterfeit Microsoft 365 sign-in, a fake banking portal, a malicious OAuth consent page, or a credential-harvesting site. The QR code was not the vulnerability. Trust in the context was.

QuishingA QR code hides the destination until the user scans it.

Identity TheftA convincing destination can capture credentials or session approval.

Authority AbuseTrusted meetings, executives and brands lower normal suspicion.

Board question: If a trusted message reaches the right person, what control prevents the human decision from becoming a financial, regulatory or reputational event?

This was a controlled awareness demonstration. This page contains no credential fields, forms, analytics, cookies, tracking scripts or downloads. It did not request passwords, OTPs or personal information, and it did not attempt to install anything on your device.