> For the complete documentation index, see [llms.txt](https://baric6.gitbook.io/barics-knowledge-base/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://baric6.gitbook.io/barics-knowledge-base/security-programs/phishing/evil-qr.md).

# Evil Qr

Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing.

It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR codes to display them on the hosted phishing pages.

Watch the demo video on Youtube <https://www.youtube.com/watch?v=8pfodWzqMcU>

Read more about it on my blog: <https://breakdev.org/evilqr-phishing>

Download&#x20;

{% embed url="<https://github.com/kgretzky/evilqr>" %}