(QR) Coding My Way Out of Here: C2 in Browser Isolation Environments

Mandiant describes a technique that can circumvent types of browser isolation (remote, on‑premises, and local) by using machine-readable QR codes to convey commands from an attacker-controlled server to a victim device, effectively enabling command-and-control despite isolation that normally only streams rendered pixels to the client. The post explains browser isolation types, why typical HTTP-based C2 is blocked by isolation, and demonstrates how QR-based channels can be abused to restore C2 capability.