Often, users don’t even need an active internet connection if the payload is self-contained. The new technique sees attackers embed base64-encoded HTML in the QR code itself.

Taylor Swift Chicago QR code mural drawing crowds in anticipation of 'Tortured Poets' release When people scan the code with their phone cameras, it took them to a 13 second YouTube short attached ...