You open an email claiming your Microsoft 365 password is about to expire, or that an urgent HR document needs a DocuSign signature. But instead of a clickable link, there’s a crisp graphic with a QR ...