A QR code is a link you cannot read. You pointed your camera, tapped once, and let a stranger's page open on your phone. Here is what this page learned in the first second, without asking you anything:
Your device
…
Your browser
…
Languages
…
Time zone
…
Your local time
…
Screen
…
How you got here
…
None of this left your phone. This page's Content-Security-Policy lets it talk to samadhisecurity.com only, and this script sends nothing at all. A malicious page would have sent all of it to its own server before you finished reading the first line.
What a malicious QR page does next
A fake sign-in page. It looks like Microsoft 365, your bank or the event Wi-Fi, and keeps the password and the MFA code you type.
A "quick payment". The US Federal Trade Commission has warned about fake QR codes stuck over the real ones on parking meters.
"Install this to continue". An app, a configuration profile or a browser extension that keeps access after you close the page.
"Allow notifications". One tap, and scam alerts arrive for months.
A look-alike address. samadhi-security.com, samadhisecurlty.com. Did you check before you tapped? You are on ….
The five-second check
Read the address in the camera's preview before you tap: the domain, not the logo.
Be wary of a sticker on top of a printed code.
Never type a password or a card number on a page a QR code opened. Go to the site yourself.
Urgency ("pay within 10 minutes", "your account is locked") is the tell.
When in doubt, don't scan. Ask for the link.
This time it was us. Samadhi Security helps teams find gaps like this one before attackers do.
你剛剛掃了一個 QR code
掃了，就信了？
你怎麼知道這不是陷阱？
QR code 是一個你看不懂的連結。你舉起相機、點一下，就讓一個陌生人的網頁在你手機上打開了。這一頁在打開後一秒內，沒問你任何問題，就知道了這些：
