QR-PHISHING EMAIL TEMPLATE (for real-Gmail testing — like the SquareX demo)
==========================================================================
Compose a new email TO YOURSELF in Gmail, paste the Subject + Body below,
then insert the QR image (qr-ms.png → micros0ft.com) INLINE where marked, Send.

SUBJECT:
Immediate Action Required: Update your password

BODY:
Dear User,

Our security team has detected unusual sign-in activity on your corporate
account. To keep your account secure, your password must be reset today.

Since your computer might already be compromised, please use your mobile
device and scan this QR code to reset your password:

[[ INSERT QR IMAGE INLINE HERE — Gmail toolbar: Insert photo (the 🖼 icon) →
   Upload qr-ms.png → choose "Inline" ]]

Please complete this update by the end of the day to avoid being locked out
of your account permanently. This measure is crucial to protect your personal
information and maintain the integrity of our network.

We apologize for any inconvenience this may cause and appreciate your prompt
attention to this matter. If you encounter any issues or have any questions,
please reach out to me.

Thank you for your cooperation.

Best regards,
Arthur
Technical Specialist
IT Department

EXPECTED (with BDR v0.3.5 loaded, on mail.google.com):
- The QR briefly shows a "Checking QR…" spinner (unscannable), then flips to
  "Blocked by VIYUH BDR — malicious QR — scanning disabled — https://micros0ft.com/verify".
- The inbox stays usable; no page block.
- SW console: [qr-mail] decoded … micros0ft.com  →  DETECTION [high] qr-quishing (mail).

VARIATIONS:
- Swap qr-ms.png for qr-paypal.png / qr-amazon.png → still blocked (different brand).
- Swap for qr-clean.png (github.com) → loader appears then CLEARS (legit QR, scannable). No FP.