For this “new” hacking vector, someone gets a phishing email asking them to scan a QR code, that code redirects to a malicious link (usually to steal credentials) and an account takeover occurs.

These codes often lead unsuspecting users to fake websites that trick them into thinking there’s an urgent problem, like a package that wasn’t delivered or an issue with your account.