QRLJacking: Hijacking QR Code Based Login System is a QR-code-based authentication system that allows users to quickly sign into a website without having to memorize or type in any username or password. The attacker initializes a client side QR session and clones the Login QR Code into a phishing page. If convinced, the victim scans the QR Code with a specific targeted Mobile App. Mobile app sends the secret token to the target service to complete the authentication process. As a result, attacker gains control over the victim’s account.
Source: https://thehackernews.com/2016/07/qrljacking-hacking-qr-code.html