Cisco Talos says the UAT-11985 emails share one syntactic skeleton, with swapped QR posters pulling victims into a live adversary-in-the-middle…