Sophos describes a QR code phishing (quishing) campaign that targeted its employees in an attempt to steal information.