Security experts at Garda have identified a vulnerability in QR-based authentication mechanisms used by various digital services. The flaw allows unauthorized access to user accounts without requiring the theft of passwords.
The attack involves a perpetrator generating a QR code for login and extracting the associated deep link. This link is then sent to a victim via email or messaging apps. When the victim clicks the link, their official mobile app prompts them to confirm the login.
Once the user approves the request, the attacker gains full access to the account. Senior security analyst Egor Borovinskikh notes that these attacks are difficult to detect because confirmation prompts often lack details about the login location or device.
To mitigate these risks, experts recommend restricting QR authorization to built-in scanners and disabling the ability to open such links manually. Users are also advised to ignore any unexpected authorization requests, even if they appear to originate from legitimate applications.