Phishing campaign used QR codes to target large energy company