QR codes bypass browser isolation for malicious C2 communication

Mandiant demonstrated a proof-of-concept C2 evasion that encodes commands into QR codes displayed by remote/isolated browsers so the visual pixel stream can return to an infected host which captures and decodes the QR to receive instructions; the technique (shown with Cobalt Strike) is feasible but low-bandwidth, has latency and reliability limits, and may be mitigated by additional security controls and heuristics.