A researcher demonstrated that attackers can take over a company’s branded QR-code subdomain (e.g., qr.company.com) if the company stops using a QR vendor but forgets to remove the DNS record. Anyone scanning a legitimate printed QR code can then be redirected to an attacker-controlled website, enabling phishing or fraud while the link still looks like the real company domain.
A researcher demonstrated that branded QR-code subdomains, such as qr.company.com, can be hijacked if a company stops using a QR vendor but forgets to remove the DNS CNAME record pointing at that vendor's platform. Because the record still exists, an attacker can claim the abandoned subdomain through the vendor's platform and set a new redirect destination. Anyone who scans an already-printed QR code, whether on packaging or a conference stand, is then sent to attacker-controlled content while the link still displays the company's own domain.
The root issue was a verification gap: the vendor platform only checked that a DNS record existed, not who actually owned or controlled the subdomain behind it. This meant any account holder on the platform could claim a subdomain that was still pointing at it but was no longer actively registered by the original company. The researcher noted the entire takeover process takes under a minute. On top of that, people tend to trust QR codes more than email links, especially when the resulting page shows a familiar corporate domain, making the redirect far less likely to be questioned.
Organizations should treat QR codes with the same scrutiny as links: verify destinations and be cautious of unexpected login or payment prompts, even when the domain looks branded. IT and web teams should periodically audit DNS records after campaigns end or vendors are discontinued, removing stale CNAME entries that still point to third-party platforms. Where custom domains are used with SaaS platforms, ownership should be verified using a unique token published in a TXT record rather than relying on the mere existence of a DNS record. Because printed QR codes can't be recalled the way software can be updated, sensitive actions such as logins or payments should not depend solely on a scanned link, and teams should prefer short-lived or centrally managed redirects for any QR campaign tied to physical materials.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If a company stops using a QR-code vendor but leaves the DNS record pointing to that vendor's platform, an attacker can claim the abandoned subdomain and redirect any scan of an already-printed code to a destination they control.
The platform only checked that the DNS record existed, not who actually controlled or owned the subdomain, which allowed any account holder to claim it.
The researcher reported finding hundreds of vulnerable companies across manufacturing, healthcare, financial services and technology.
They should remove stale DNS records for unused vendor integrations and require a unique ownership token published in a TXT record before a custom domain can be claimed.
You know those QR codes on our packaging and conference stands? Those can be hijacked even if they still show our real domain. A researcher showed he could claim abandoned QR subdomains like 'qr.company.com' on a vendor’s platform, then send every scan to his own site, while phones still displayed the real corporate domain. Someone scans an old campaign QR, sees 'qr.company.com', but lands on a page asking for login or payment that doesn’t match our usual look. People who distrust email links rarely question a code on packaging or a conference stand. Here’s the move: if a QR to our domain ever asks for credentials or payment, stop and report it to security, include a screenshot of the page and the 'qr.ourcompany.com' address your phone shows.
Researchers report that the WeedHack malware campaign is still infecting people through convincing fake Minecraft client/mod websites, even after its command-and-control server was disrupted. Attackers use SEO poisoning and trusted community platforms (like Discord and Minecraft modding sites) to…
Anthropic says it disrupted a Russian state-linked campaign that used Claude to continuously rebuild malware when security tools detected it. The group (GTG-20006, linked to Midnight Blizzard/APT29) ran phishing and other human-targeted schemes, including device-code token theft against Microsoft…
A commonly used documentation placeholder domain, third-party.com, was registered by an unknown party and is now serving a ClickFix social-engineering lure to Windows users. The page pretends to run a Cloudflare security check, silently poisons the clipboard, and tells victims to paste and run a…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
Attackers impersonated LastPass on GitHub and tricked people searching for the “LastPass Authenticator download” into installing a fake installer. The infection chain used a Microsoft-signed driver to disable many security tools, then deployed an infostealer that stole passwords, crypto wallets,…
