You have 1 previous attempt for this scenario. Submitting again will create a new attempt and show a comparison against your most recent response.
QR Code PhishingDifficulty · easyHigh asset
Self-report: scanned a QR poster in the lobby, entered M365 credentials
From
Daniel Park <daniel.park@acme-corp.com>
To
soc@acme-corp.com
Date
2026-05-08 10:47 UTC
Hi SOC,
I think I just got phished. Around 10:20 this morning I scanned a printed QR poster taped near the visitor parking sign-in counter. The poster said "Free Visitor Parking Validation — Scan QR to Validate" and looked official.
The QR opened a short link in my work iPhone browser, which redirected to a Microsoft 365 sign-in page at m365-validate-acme[.]xyz. I entered my work email and password. The page returned a "thanks" screen and bounced me to office.com. There was no challenge (I think my phone had a cached M365 session).
I noticed the wrong domain about 15 minutes later when I looked back at my browser history. The poster is still on the lobby wall as of 10:42.
Please advise. I have not changed my password yet — wanted to ask first.
— Daniel (Finance)
Evidence
Mobile proxy log + Entra ID sign-in audit + lobby observation
# Corporate mobile proxy log (device=daniel-iphone, BYOD-enrolled)
10:21:08 GET https://lnk.short-url[.]co/p9k2x 302
10:21:09 GET https://m365-validate-acme[.]xyz/auth?u=daniel 200 (TLS, cert: Let's Encrypt, age 6d)
10:21:47 POST https://m365-validate-acme[.]xyz/auth/submit 302
10:21:48 GET https://office.com/ 200
# Phishing domain WHOIS / reputation
m365-validate-acme[.]xyz registered 2026-05-02 (6 days ago)
ns: hosted on low-reputation provider, no MX
cert: Let's Encrypt, issued 2026-05-02
# Entra ID sign-in log (user: daniel.park@acme-corp.com)
10:43:22 FAILED src=23.94.184.55 (US, hosting) reason=ca_non_compliant_device
app: Outlook Web MFA: Not challenged (request blocked at CA)
UA: Edge/Windows (distinct from daniel-iphone)
# Lobby observation (provided by reception lead)
- Poster taped on the wall to the right of the visitor parking sign-in counter.
- Reception did NOT authorize the poster; first noticed by morning shift at 09:30.
- Building CCTV shows an unidentified person in a navy jacket taping the poster up at 18:42 the previous evening.