QR code vulnerability allows attackers to hijack branded domains

* A security flaw exists in QR Tiger's custom domain feature, termed "QR Jacking."
* Threat actors can hijack abandoned branded QR code domains.
* The vulnerability allows redirection of users scanning legitimate QR codes to malicious websites.
* This occurs even when phones display the company's authentic domain initially.
* The issue stems from the "Own Short Domain" feature not adequately verifying domain ownership upon custom domain addition.
* Attackers can claim subdomains if a business stops using QR Tiger but leaves its DNS records pointing to the platform.
* This enables traffic redirection from existing QR codes (packaging, signage) to controlled sites.
* Hundreds of exposed subdomains were identified across manufacturing, healthcare, financial services, and technology sectors.
* The technique can be used to direct users to phishing pages for credential or personal information theft.
* No fix has been implemented by the platform despite reporting.
* Organizations are advised to review DNS records for QR platforms and remove unused integrations.

The narrative highlights a failure in asset lifecycle management embedded within third-party domain services, where the persistence of digital artifacts (DNS records) outlives the active contract or usage with the service provider creates an exploitable gap. The core pattern involves latent ownership—a right that exists based on historical configuration rather than current operational control. This moves beyond a simple bug and into an issue of digital residue and accountability. The implication is that security is not just about securing the immediate transaction but managing the long-term digital footprint left behind by operational decisions. The lack of remediation suggests a prioritization gap between feature deployment and continuous risk assessment, allowing residual exposure to persist indefinitely. The focus on directing users to phishing pages connects this technical flaw directly to the potential for real-world harm—credential theft in regulated sectors. The missing piece is the systemic response regarding responsibility: who owns the responsibility for auditing and cleaning up these dangling digital assets?
Bridge Questions: How should domain registration policies be structured to mandate automatic revocation or ownership verification when a service relationship ends? What governance structures are necessary to enforce continuous security audits on external platform integrations, and who bears the liability when such omissions lead to credential theft? What framework can be established for third-party services to ensure that digital assets reflect current operational consent rather than historical configurations?