Threat actors are abusing Microsoft Sway to host QR Code phishing campaigns.