Malicious QR code leaflets are now being delivered by air. According to a report published by the Kyiv Post on 5 November 2026, Ukrainian forces found single-page flyers carrying scannable QR codes inside a downed Russian drone near Kyiv, and Ukraine's Unmanned Systems Forces said the codes lead to websites linked to Russian intelligence. The setting is extreme, but the lesson is ordinary: a printed QR code is only as trustworthy as the place it points to, and scanners cannot see that place before they scan.
Disclosure: we make D-QR, a dynamic QR code platform, so we have an interest in this topic. We have tried to keep this article to what was reported and to what software can honestly do.
What was reported about the Kyiv drone leaflets
The account below comes from the Kyiv Post report by Stefan Korshak. We have not independently verified the military details, and several of the claims are attributed in that article to the Unmanned Systems Forces (USF) statement and to a Telegram post by a Ukrainian battalion, so we use "reportedly" throughout.
The drone and the flyers
Reportedly, a Russian drone carrying propaganda leaflets was shot down by a Ukrainian anti-drone unit and came down near positions on an approach route to Kyiv. The warhead did not explode, but a fuel fire damaged the drone and part of its payload. Soldiers who reached the site found single-page flyers, each with a QR code. The Kyiv Post says video from a foot patrol showed dozens of launch containers packed with paper, apparently meant to scatter leaflets over civilians.
The two flyer designs
The article describes two designs, again citing the USF statement. One falsely claimed that Russia's armed forces had formed a volunteer unit of Ukrainians and invited readers to scan a code to "vote" on the unit's name. The other showed photos of men in police or military uniforms detaining civilians, and its code promised advice on avoiding street conscription. The USF reportedly said both codes lead to websites linked to Russian intelligence and that the codes would collect the finder's location and personal information.
Not the first time
The Kyiv Post also lists earlier cases, each with its own attribution. It reports that fake banknotes carrying QR codes were dropped in the Chernihiv area in September 2025 and found in Chernihiv and Sumy regions in early April 2026, though it names no agency for those. It also cites Google's Threat Intelligence Group, which in February 2025 documented a Russian campaign using QR codes disguised as Signal group invitations to target Ukrainian military personnel. The pattern is consistent: a code is cheap to print, looks harmless, and moves the attack from paper to a phone.
Why malicious QR code leaflets work anywhere
Strip away the war setting and the mechanics are the same as in a quishing email or a sticker on a parking meter. A QR code is just encoded text, usually a web address. A person cannot read it, so they scan it and trust the result. Attackers exploit three things:
- Curiosity and urgency. A "vote", a prize, a warning about being detained. The call to action is designed to be scanned quickly.
- Anonymity of the medium. Paper does not show where it came from. A flyer found on the ground, a poster on a wall and a sticker on a machine all look the same.
- The phone as the real target. The code leads to a page that asks for details, or to one that tries to get something installed. Our guide on whether QR codes are safe covers what a scan can and cannot do by itself.
We have covered the same logic in other settings, such as altered event posters with malicious codes. The common thread is that the person who scans cannot verify the sender, and the person who prints cannot control every surface the code ends up on.
How to spot a trap code before you scan
These habits apply whether the code arrives by drone, post or sticker:
- Ask where it came from. A code on an unsolicited leaflet or a flyer you found is not a trusted source, however official it looks.
- Preview the address. Most phone cameras show the web address before opening it. If it is a shortener you do not recognise or a name that does not match the sender, stop.
- Distrust prizes, votes and threats. Offers and alarming notices that push you to scan quickly are the classic bait.
- Do not enter personal or payment details on a page you reached from an unknown code.
- Look for overlays. On signs and machines, check whether a sticker sits on top of the original code.
What a dynamic QR platform can help with
If you are an organisation that prints codes, the Kyiv case raises a practical question: what happens when someone abuses your channel, or when your own code stops being safe? A dynamic QR code points at a short address you control, and the destination behind it can be changed. That gives you several real tools, all of which exist in D-QR today:
- Pause or re-point in seconds. If a code you issued is being abused, or its destination has to change, you can pause it or re-point it, and every printed copy follows. No reprint is needed.
- Scan logs. Each code records scans with country, city and device, so an odd spike from a place you never printed in becomes visible. See QR code tracking and scan analytics.
- Alerts and webhooks. On the Pro plan you can be notified about scans and send them to your own systems.
- Bot filtering. Link previews and crawlers are counted separately, so the numbers you act on are people. More on bot filtering.
- Per-code controls. Country restriction, a password and an expiry date can be set on a code. Codes have no expiry unless you set one.
- Custom domains. On Pro, codes can use your own domain, so the visible address looks like yours.
- CSV export of scan data, for audits and reports.
For campaigns that run on paper, this is the sensible default described in our guide to QR codes in marketing campaigns and on the marketing campaigns page: keep control of the destination after printing.
What software cannot fix
It is worth being blunt here, because the Kyiv incident is a good example of the limits. A dynamic QR platform controls your codes. It cannot control a code someone else prints.
- If an attacker prints their own code on their own leaflet, nothing in any QR platform touches it. That is what reportedly happened in the drone case.
- If someone sticks an overlay over your printed code, the scan never reaches your account, so your logs show nothing. Re-pointing your code does not help, because the overlay is a different code. Only physical checks, tamper-evident labels and a visible short address people can compare will help.
- Pausing a code you control does not remove copies that already scattered, and it cannot tell a person who reads your code from a person who reads someone else's.
- A scan log tells you what happened after the fact. It does not stop the first scan.
The honest summary: dynamic codes shrink the damage when the problem is on your side (a wrong or compromised destination), and they give you evidence. They do not make a hostile code trustworthy.
A short checklist for organisations that print codes
- Print the destination domain in plain text next to the code, so people can compare what they see with what they scan.
- Use a domain you own, and keep it renewed. Control of the address is control of the code.
- Audit the places your codes are displayed, and replace any that look tampered with.
- Watch scan logs for unusual countries or devices, and set up alerts if your plan includes them.
- Know in advance who can pause or re-point a code, and how fast, so an incident takes minutes.
- Never use urgency, prizes or threats in your own QR calls to action. It trains people to scan on impulse.
If you only need a quick start, you can create a QR code without an account, and the dynamic QR code guide explains what changes when a code can be edited after printing.