Once the QR code has been scanned and has become active, malicious JavaScript can then simulate login portals, exfiltrate data via hidden forms and fingerprint devices for further exploitation.

Once opened in a browser, the code decrypts a secondary payload using a static XOR key and then redirects the user to an ...