Detects inbound messages containing a PDF attachment that matches a predefined YARA template named pdf_small_qr_phishing_template, indicating a QR-code based phishing structure designed to harvest credentials. The rule requires a PDF file in the inbound payload and applies a YARA match against the template. It also includes QR code analysis to confirm the presence of a QR-encoded phishing payload within the document. Detection methods include File analysis, YARA, and QR code analysis. Severity is medium, aligning with credential harvesting risk from embedded QR codes in PDFs.