[Pikami]

Discord recently introduced logging in via QR code, witch is pretty handy when desktop version randomly decides to log you out.
However as you may have noticed, a small exploit exists: a person can create a QR code and trick some one else to scan it, this way that person would get full access to the victim's account.

[Pikami's fun tips]

For people using discord: NEVER and I mean NEVER scan a QR code for Discord-related gifts or prizes including Nitro giveaways, trough the Discord mobile app, EVER.
You are NOT redeeming the "prize", you're giving someone FULL access to your account, regardless of 2FA. Until Discord adds a notice to their app, you'll have to be extremely cautious about this.
For server owners: Please inform your members and staff about this feature to avoid spam/server takeover.
For the black-hats out there: (the mentioned timing values are taken at the time of writing and might change)

• The QR code is present on the login page of discord.
  
• You have to keep the page open for the QR code to be valid since a heart-beat packet is sent roughly every 41 seconds.
  
• The QR code is only valid for 2 minutes, so you need to keep updating it until someone scans it.