<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-qr-code-phishing
description: >-
  Detect and analyze QR code phishing (quishing) attacks in emails, documents,
  and physical media. Covers QR code decoding, embedded URL extraction,
  gateway detection capabilities, and mobile-specific attack chain analysis.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - quishing
  - qr-code-phishing
  - qr-code-analysis
  - mobile-phishing
  - email-security
  - image-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Analyzing QR Code Phishing

## Overview

QR code phishing (quishing) embeds malicious URLs in QR codes delivered via
email, documents, or physical media. This technique bypasses traditional URL
scanning because the URL is encoded as an image rather than text. This skill
covers QR code extraction and decoding, embedded URL analysis, gateway
detection limitations, and defense strategies.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| `zbarimg` | `apt install zbar-tools` or `brew install zbar` |
| `pyzbar` | `pip install pyzbar` |
| `Pillow` | `pip install Pillow` |
| `qrcode` | `pip install qrcode` (for test generation) |

## Key Concepts

### Why QR Phishing Works

```
Attack Chain:
1. Attacker generates QR code containing malicious URL
2. QR code embedded in email as image (PNG/JPG)
3. Email gateway scans text/HTML — finds no URLs to analyze
4. User scans QR with mobile phone camera
5. Mobile browser opens URL with minimal security controls
6. Credential harvesting page loads on mobile device

Key Advantages for Attacker:
├── Bypasses email URL scanning (URL is in image, not text)
├── Forces interaction on mobile (less security tooling)
├── Mobile browsers show less URL information
├── Users trust QR codes (ubiquitous in payments, restaurants)
├── No hover-preview capability on QR code
└── Difficult to detect at scale without image analysis
```

### Common Quishing Pretexts

| Pretext | Delivery | Target |
|---|---|---|
| MFA setup/reset | Email with QR code | All employees |
| Document access | "Scan to view document" | Knowledge workers |
| IT password reset | "Scan to update credentials" | All employees |
| Parking/building access | Physical QR code sticker | Facility users |
| WiFi setup | Physical QR code poster | Office visitors |
| Payment/invoice | Email with QR code for payment | Finance team |

### Detection Challenges

```
Why gateways miss quishing:
├── URL is encoded as image pixels, not text
├── Standard email scanning inspects text/HTML links
├── Image-based QR scanning requires OCR/CV capabilities
├── Base64-encoded inline images add processing overhead
├── Multiple QR codes per message increase false positives
└── Legitimate QR codes in signatures cause noise
```

## Workflow

### 1. QR Code Extraction from Email

```bash
# Extract images from email file
munpack email.eml
# Or extract base64 images from HTML
grep -oP 'data:image/[^"]+' email.html | head -5

# Decode QR code from image
zbarimg --quiet --raw /tmp/qr_image.png

# Automated extraction and analysis
node agent.js decode /tmp/qr_image.png
```

### 2. URL Analysis

```bash
# After decoding QR code, analyze the embedded URL
node agent.js analyze-qr /tmp/qr_image.png

# Check decoded URL against threat feeds
node agent.js check-url "https://decoded-url-from-qr.com"
```

### 3. Batch Email Scanning

```bash
# Scan email directory for QR codes
node agent.js scan-emails /tmp/email_samples/

# Generate detection statistics
node agent.js scan-report /tmp/email_samples/
```

### 4. Test QR Code Generation

```bash
# Generate test QR codes for simulation campaigns
node agent.js generate-test --url "https://phishing-sim.company.com/qr-test" --output /tmp/test_qr.png
```

## Detection

```yaml
title: Qr Code Phishing Detection
id: ccc03306-3666-4a37-9dc5-8e108bac4971
status: experimental
description: Detects suspicious activity related to analyzing qr code phishing techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| QR code decoded | `zbarimg` or `pyzbar` extracts URL |
| URL analyzed | Decoded URL checked against threat feeds |
| Gateway detects QR | Test QR phishing email blocked by gateway |
| Mobile defense active | MDM/MTD configured for URL filtering |
| User awareness | Quishing included in security training |
| Simulation tested | QR code phishing simulation completed |

## References

- [Abnormal Security — QR Code Phishing](https://abnormalsecurity.com/glossary/quishing)
- [Microsoft — QR Code Phishing Trends](https://www.microsoft.com/en-us/security/blog/)
- [MITRE T1566.001 — Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
- [ZBar Library](https://github.com/mchehab/zbar)
- [pyzbar Documentation](https://github.com/NaturalHistoryMuseum/pyzbar)
