Security specialists at Garda warn that QR code login, used by banks, marketplaces and messengers, can let someone hijack an account without any password if it is built carelessly. They say they have run into such flaws repeatedly while auditing web applications.
The trick is that the victim approves the login in the real, official app. There is no fake website involved, which makes it much harder to spot than ordinary phishing.
How the attack works
The attacker opens the service's login page on their own machine and gets a QR code. They extract the deep link hidden in it, which opens the mobile app straight on the approval screen, and send it out by messenger or email.
The victim taps the link, the official app opens with a login request, and a single tap on Confirm hands the session on the attacker's computer, with all the account data, to someone else.
Why it matters
That kind of access can reach money and personal data at a bank or marketplace. The approval prompt often doesn't show which device or location the login comes from, so the user has nothing to tell their own request from a stranger's.
What is recommended
Developers are advised to allow QR login only through the app's built-in scanner and to reject such links opened manually. Users are told not to approve a login they didn't start themselves, even when the request appears in the real app.
Our take
If your site offers QR code login, show the device, browser and rough location on the approval screen, keep the code alive for a minute at most and bind it to the session that requested it. It's not much work, and it takes most of the punch out of the forwarded link trick. More at CNews.