Instead of getting six-digit log-in codes via SMS, which is unsafe and prone to phishing, users will see a QR code that they can scan with their phone’s camera.

At that point, the two-factor codes from Google go right to the attacker, allowing them to log in. This same attack has been used to access crypto wallets and make off with valuable digital currency.