QR phishing embeds scannable codes in email markup, bypassing image-based defenses and directing victims to credential-stealing sites.