6 · QR / quishing (HIGH). A phishing link hidden inside a QR image. BDR decodes the QR and checks the URL. This QR encodes https://paypa1.com/login (look-alike of paypal). Watch the page console for [BDR] QR decoded on page: …, then the SW console for DETECTION [high] qr-quishing.
Malicious QR — should detect
Clean QR — should NOT detect
If nothing fires, re-open the page (the QR may have still been loading on the first scan).