QR Codes Manipulated to Redirect Users to Illegal Websites in China
Chinese authorities have exposed a widespread issue where common QR codes are being manipulated to direct users to illegal websites, affecting public spaces and children's products alike.
Chinese tech portal IT Home has reported on a prevalent problem where QR codes found in public spaces, and even on children's products, have been hijacked to redirect users to illegal or harmful websites, often featuring adult content or scams.
The investigation into these incidents began as users started reporting unusual experiences. In March 2026, a visitor at the Shangying Yanshan Forest Park noticed a QR code on a shuttle bus leading to an adult website. Shortly after, in late February, another user in Beijing reported a QR code on a public facility on the street redirecting to a similar illegal site.
According to IT Home, the issue extends beyond public areas. QR codes printed on children's educational materials, such as flashcards and toy packaging, and even on the back covers of art practice books for primary school students, have been found to be maliciously altered. These codes have directed users to harmful and illegal sites.
Network experts explain that the root cause lies in the domain names that QR codes point to. A QR code itself has no security features; the vulnerability lies in the domain it references. The most common reason for these identified issues is when the original registrants of the domain names—whether individuals or organizations—stop paying renewal fees. Once the domain expires, it can be maliciously re-registered by illicit actors.
Experts advise that organizations should not only ensure the security of domains during their active use but also consider the management of QR codes and domains after a service has ended. "Leaving 'digital unfinished projects' can create significant security loopholes," noted an expert, referring to situations where outdated or unused domains remain vulnerable.