QR Jacking (Karimi / iTnews 25 Sep): stale CNAME to QR Tiger “Own Short Domain” lets attackers reclaim branded qr.company.com redirects
iTnews (Juha Saarinen, 25 September 2026 17:57 AEST) covers Farzan Karimi’s “QR Jacking” research (primary blog on jumpycastle.dev): QR Tiger’s Own Short Domain / branded short-URL feature accepted a customer CNAME (e.g. qr.company.com) after checking only that the DNS record existed — not who owned the claim. When a company ends a campaign and leaves the CNAME pointing at QR Tiger without an active registration, any new QR Tiger account holder can claim that subdomain and redirect every still-circulating printed/packaged QR code while the phone still shows the company’s own domain and HTTPS. Karimi says hundreds of orgs across manufacturing, healthcare, finance and tech were exposed; told iTnews QR Tiger had not fixed the flaw five months after disclosure; plans to release a scanner (“QR Tiger King”) on GitHub and extend findings to other QR vendors. Mitigation: remove unused CNAMEs; require TXT ownership tokens (standard SaaS domain verify). Distinct from OWASP QRLJacking (2016 login-QR session theft). Australia-weighted via iTnews primary wire. Primary: Karimi blog; wire: iTnews.
- Product
- QR Tiger Own Short Domain / branded QR CNAME integrations (and similar QR SaaS custom-domain features)
- Versions
- n/a (platform domain-claim design + stale customer DNS; vendor fix status unresolved per researcher as of iTnews report)
- Exploited in Australia?
- unknown
- Patch to
- Audit and delete unused CNAMEs pointing at QR/short-link SaaS; require TXT-based domain ownership verification before accepting custom domains; rotate any campaign QR destinations still needed onto a domain you fully control; monitor certificate transparency for unexpected certs on qr.* subdomains.
Primary: Farzan Karimi — Introducing QR Jacking (jumpycastle.dev) · Vendor: Researcher blog (primary) · iTnews — Abandoned QR code subdomains open to hijacking (25 Sep 2026)