QRLog is a Java remote access tool hidden inside an otherwise legitimate open-source QR code generator. Malicious code embedded in QRCodeWriter.java determines the host operating system, decodes a Base64 blob, writes QRLog.java into a temporary directory, and executes it. The decoded component contacts a command-and-control endpoint and, after the expected response, writes additional files that open a reverse shell with privileged access. The trojanized application was observed in February 2023, and infrastructure analysis associated the activity with the DPRK-linked Labyrinth Chollima actor.