Normally, Pokémon cheaters have to use devices like Action Replay to get rare (but hacked) Pokémon. But, recently, Pokemon players found an exploit that uses nothing but the 3DS camera to get rare or unreleased Pokémon — and it's ridiculously simple to pull off.
As detailed in a post by Frocharocha, as long as you don't have the New 3DS, you can acquire rare Pokémon with much ease now. That is, if you have one of the newer Pokémon games, like X & Y or Omega Ruby and Alpha Sapphire.
First, you'll need to go to your 3DS browser, and delete both your history and cookies. You can find both of these options in the settings menu:
Then, you need to access your in-game PC in whatever Pokémon game you're playing, and you need to leave the first slot in the first box empty, like so:
Try the 'organise boxes' option for the fastest results.
Then, after making sure that your character is still standing in front of the PC, press the home button on your 3DS. Open up the camera. You can do this quickly by pressing the L and R buttons on your 3DS.
Tap on the QR code reader icon, and scan your desired QR code. There are a number of QR codes available, including:
Folks also have the option of generating their own QR codes here, but it can only be done via the usage of a Pokémon hacking program. There is also a subreddit dedicated to QR codes for this exploit, as well as a public Google Doc containing a list of QR codes.
Once you scan a code, you should get something like this:
Tap 'OK.' The 3DS should ask you if you want to open up the link. If you say yes, the browser will crash, and you'll get an error message. From here, you can go back into your game. Open up the PC, check the first slot, and voila. Your hacked Pokémon awaits.
I tried this out last night, and was able to just give myself a Mew and an Arceus, easy. The process took only a few minutes.
Of course, these aren't legitimate Pokémon or anything — so it's not exactly gratifying to just scan whatever Pokémon I desire. People do have different philosophies when it comes to hacked fake Pokémon, even though they can often be functionally identical to legit Pokémon. For now, it's unclear whether or not this exploit will be patched, but let's be real: it's not like there are normally any shortage of hacked Pokémon floating around anyway.