QR codes bypass browser isolation for malicious C2 communication