본문으로 건너뛰기
cccskills
무료GitHub에 공개

detecting-qr-code-phishing-with-email-security

Investigate phishing emails that hide malicious links in QR codes. Decode destinations, analyze suspicious URLs, configure email detection rules, and plan mobile protections and awareness training for people who scan codes on their phones.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

원문원문 설명 보기

Detect and prevent QR code phishing (quishing) attacks that embed malicious URLs inside QR code images to bypass link-based email security, using image-based threat detection, OCR/QR decoding, and mobile-side scanning (Microsoft Defender for O365, Proofpoint TAP, Barracuda Multimodal AI). Use when configuring gateway rules against QR phishing or investigating suspicious emails containing QR codes.

설치 방법 보기

이럴 때 유용합니다

  • Investigating suspicious emails containing QR codes
  • Configuring QR detection for email images and PDF attachments
  • Protecting phones from malicious QR destinations
  • Training employees to recognize and report QR phishing

포함된 파일(8)

  • SKILL.md6.6 KB
  • assets/template.md1.5 KB
  • LICENSE11.0 KB
  • references/api-reference.md2.4 KB
  • references/standards.md1.6 KB
  • references/workflows.md2.5 KB
  • scripts/agent.py5.9 KB
  • scripts/process.py11.5 KB

SKILL.md(원문)

설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.

Detecting QR Code Phishing with Email Security

Overview

QR code phishing (quishing) is a rapidly growing attack vector where malicious URLs are embedded in QR code images within phishing emails. Quishing incidents grew fivefold from 46,000 to 250,000 between August and November 2025, with credential phishing comprising 89.3% of detected incidents. Traditional email security filters struggle because QR codes cannot be read by humans or standard URL scanners, and when scanned, users typically use personal mobile devices that lack corporate security controls. Attackers have evolved to use split QR codes (two separate images), nested QR codes, and ASCII text-based QR codes to evade detection.

When to Use

  • When investigating security incidents that require detecting qr code phishing with email security
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Email security gateway with image analysis capabilities
  • Understanding of QR code structure and encoding
  • Mobile device management (MDM) or mobile threat defense solution
  • Security awareness training program
  • SIEM platform for correlation and alerting

Key Concepts

Why Quishing Works

  1. Bypasses URL Scanners: Traditional gateways scan text-based URLs but cannot decode image-embedded URLs
  2. Shifts to Unprotected Devices: Corporate email arrives on secured systems but QR scan occurs on personal mobile devices
  3. User Trust: QR codes are normalized in daily life (payments, menus, parking)
  4. Low Detection Rate: Only 36% of quishing incidents are accurately identified by recipients

Evasion Techniques (2025)

  • Split QR Codes: QR code divided into two separate images that look benign individually (Gabagool PhaaS kit)
  • Nested QR Codes: QR code within a QR code, with first scan leading to intermediate page
  • ASCII QR Codes: QR rendered as text characters instead of images, bypassing image analysis (12% of attacks in Jan 2026)
  • Styled/Artistic QR Codes: Custom-designed QR codes with logos that evade pattern matching
  • PDF Attachment QR: QR code embedded in PDF attachment rather than email body

Detection Challenges

  • Pattern-based detection faces trade-off: aggressive tuning causes false positives, cautious tuning causes misses
  • Average similarity score of 0.209 between quishing and legitimate QR emails
  • QR codes in image attachments require OCR and deep image processing

Workflow

Step 1: Enable Image-Based Threat Detection

  • Configure email gateway to scan embedded images for QR codes
  • Enable OCR processing on image attachments (PNG, JPG, GIF, BMP)
  • Deploy multimodal AI that combines image processing, OCR, and NLP analysis
  • Configure PDF scanning to detect QR codes within attachments
  • Set up detection for ASCII/text-based QR code rendering

Step 2: Configure QR Code URL Analysis

  • Extract URLs from detected QR codes and submit to URL reputation services
  • Apply same URL scanning policies to QR-extracted URLs as text-based URLs
  • Enable real-time sandbox analysis for QR-decoded destination pages
  • Configure time-of-click protection for QR-extracted URLs where possible
  • Block known phishing domains extracted from QR codes

Step 3: Deploy Mobile-Side Protection

  • Implement mobile threat defense (MTD) with QR code scanning capability
  • Deploy Palo Alto ALFA or equivalent safe-by-design QR scanning
  • Configure MDM policies to warn users before opening scanned URLs
  • Enable corporate VPN/secure browser for QR-scanned destinations
  • Block known credential harvesting domains at the mobile proxy level

Step 4: Build Detection Rules

  • Alert on emails containing only an image and minimal text (common quishing pattern)
  • Flag emails with QR code images from external first-time senders
  • Detect urgency language combined with QR code presence
  • Alert on emails impersonating IT/security team requesting QR scan for MFA setup
  • Monitor for common quishing themes: MFA reset, document signing, voicemail notification

Step 5: Train Users on Quishing Recognition

  • Update security awareness program to include QR code phishing scenarios
  • Conduct quishing simulation campaigns using controlled QR codes
  • Teach users to verify QR destination URLs before entering credentials
  • Establish reporting process for suspicious QR code emails
  • Distribute guidance on safe QR scanning practices

Tools & Resources

  • Barracuda Multimodal AI: OCR + deep image processing for QR detection
  • Palo Alto ALFA: Safe-by-design QR code scanning assessment
  • Microsoft Defender for O365: QR code detection in email images
  • Proofpoint TAP: Image-based threat analysis with QR decoding
  • Lookout/Zimperium: Mobile threat defense with QR scanning

Validation

  • QR code phishing emails detected in controlled testing
  • Split QR code and ASCII QR code evasion techniques caught
  • QR-extracted URLs submitted to sandbox analysis
  • Mobile devices alert on malicious QR destinations
  • User reporting rate for quishing simulations exceeds 50%
  • False positive rate for QR detection below 1%

리뷰

아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.

댓글

로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.

아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.

보내면 바로 공개됩니다. 이메일 주소나 전화번호 같은 개인 정보는 쓰지 마세요. URL은 2개까지입니다.

0 / 1,000자

이 양식은 reCAPTCHA로 보호되며 Google 개인정보처리방침 및 서비스 약관이 적용됩니다.

같은 저장소의 스킬

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Assessing saved credential exposure in authorized tests
  • Examining collected DPAPI files offline
  • Reviewing protected browser and RDP credentials
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Assessing risky permissions identified in BloodHound
  • Validating account takeover without resetting a password
  • Generating directory change records during security exercises
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Define the assessment scope for systems handling controlled information
  • Calculate an SPRS score and prioritize unmet security requirements
  • Prepare security plans, remediation milestones, and assessment evidence
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Preserving a suspect drive before investigation
  • Creating evidence copies of USB devices or memory cards
  • Verifying that a disk image matches its source
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Auditing excessive Active Directory permissions
  • Investigating privilege escalation paths from ordinary accounts
  • Reporting affected objects and permission remediation recommendations
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

  • Triage suspicious APK files without running them
  • Inspect dangerous permission combinations and suspicious API calls
  • Extract network indicators for malware detection rules
mukul975/Anthropic-Cybersecurity-Skills3.5만2026년 8월 31일 업데이트

mukul975의 스킬 모두 보기

이 스킬의 문제 신고