QR code phishing ("quishing") — the new twist to watch for

Attackers now embed malicious QR codes in emails and even printed flyers, betting that people scan with their phone — often outside company security controls — without a second thought. Treat a QR code in an unexpected email exactly like a suspicious link: don't scan it, and if you must check where it leads, do it on a locked-down device.

Coach's tip: train people to distrust QR codes from email just as much as links — the caution has to transfer, it doesn't happen automatically.