'QR Jacking' Flaw Lets Attackers Hijack Abandoned QR Code Domains

A security researcher, Farzan Karimi, has revealed a technique called 'QR Jacking' that allows attackers to take over branded QR code web addresses belonging to legitimate companies. The issue lies in how QR code provider QR Tiger handles its 'Own Short Domain' feature, which lets businesses use a branded subdomain such as qr.company.com pointing to QR Tiger's servers via a DNS CNAME record.

Karimi found that QR Tiger only checks whether the DNS record exists, not who owns it. This means that if a company stops using the service but forgets to remove the DNS record, anyone with a QR Tiger account can claim that abandoned subdomain in under a minute, silently redirecting all existing printed QR codes tied to it. Because the destination still shows the company's own domain, people are far less suspicious than they would be of a phishing link, and printed QR codes cannot be updated or recalled like software.

Karimi said he identified hundreds of vulnerable companies across manufacturing, healthcare, financial services and technology, though none were named. He reported the flaw to QR Tiger five months ago, but said it remains unfixed. He recommends providers verify domain ownership using a unique token in a DNS TXT record, a method already common among other SaaS platforms.