A malicious QR code on a web site redirects users to a site that will install a Trojan on their Android smart phones. Once a user scans the QR code, the Trojan will send a number of SMS messages to premium-rate numbers. The Trojan is a trojanized version of the Jimm mobile ICQ client, infected with Trojan-SMS.AndroidOS.Jifake.f. Once installed, the victim will end up paying up to $6 a message premium rate.
Source: https://thehackernews.com/2011/10/qr-codes-next-way-for-android-malware.html