Abandoned QR code domains raise hijacking risk, researcher says

A security researcher has warned that abandoned branded QR code subdomains can be reclaimed through some QR code software platforms, potentially redirecting people who scan genuine printed codes to attacker-controlled sites.

The finding was reported by iTnews on September 25, 2026, based on research published by Farzan Karimi on Medium this week under the name “QR Jacking”. Karimi, who says he previously managed red teams at Google and Electronic Arts, described the issue as a weakness in QR code software-as-a-service platforms that let customers use their own short domains for QR code links.

The primary material from Karimi’s post says the problem occurs where a business has created a DNS CNAME record, such as qr.company.com, pointing to a QR platform, but later stops using the service without removing that DNS record. If the QR platform treats the presence of the DNS record as sufficient proof of control, Karimi says another account holder can claim the unclaimed subdomain and decide where QR scans are redirected.

Karimi used QR Tiger as the case study. QR Tiger’s own help material, last updated on July 7, 2025, says customers can change a standard short link such as qr1.be/wxyz to a branded link such as qr.yourcompany.com/wxyz. A separate QR Tiger page, updated on September 11, 2026, says customers prepare the feature by creating a CNAME record for the subdomain with the value qr1.be, then entering the subdomain in QR Tiger’s “Own Short Domain” area and clicking “Verify”.

Karimi alleges that QR Tiger’s verification checked that the DNS record existed, but not who was claiming it. He wrote that “anyone with a QR Tiger account can claim any unclaimed domain that points to QR Tiger’s infrastructure”. iTnews reported that Karimi said QR Tiger had not fixed the flaw five months after he reported it. The supplied evidence does not include a response from QR Tiger to the allegation.

Karimi told iTnews the issue can affect existing QR codes if a campaign’s printed codes use a subdomain that remains pointed at the provider after the company has stopped managing the integration. He also claimed he found hundreds of vulnerable companies across manufacturing, healthcare, financial services and technology, but did not publish a count or identify affected organisations.

What remains unclear is the extent of real-world exploitation, whether any Australian organisations are among the affected companies, and whether other QR providers use the same verification model. Karimi’s Medium post says disclosures are in progress with additional vendors, but the supplied evidence does not identify them.

Interpretation: The risk is less about QR codes themselves than about lifecycle management of DNS records and third-party SaaS integrations. Branded QR links are designed to increase trust, and QR Tiger’s own marketing says custom domains can boost credibility. That same trust could amplify harm if a stale subdomain is later reclaimed.

Karimi’s proposed mitigation is a stronger ownership check, such as requiring a unique token in a DNS TXT record. For organisations, the practical lesson is to audit CNAME records pointing to QR services and remove records for campaigns or vendors no longer in use.