Quishing: Phishing via Fancy QR Codes

• Quishing is a phishing technique that embeds harmful payloads in visually-stylized QR codes to deceive users and evade both URL- and visual-based defenses.
• Fancy QR codes use non-standard colorizations, artistic fill patterns, and selective distortions to mislead conventional QR scanners and deep learning detectors.
• The ALFA framework employs preprocessing, FAST correction, and an XGBoost classifier to mitigate quishing threats, achieving high recall with moderate false positive rates.

Quishing is the technique of phishing via QR (Quick Response) codes, in which attackers embed malicious payloads or links in a QR code to deceive users, often by modifying the code’s visual appearance with color or stylistic alterations that evade conventional detection methods. These “fancy” QR codes present significant challenges for both traditional URL-based and visual deep learning-based defenses, necessitating specialized detection frameworks such as ALFA (Akram et al., 11 Jan 2026).

1. Definition and Attack Surface of Quishing

Quishing leverages the 2D matrix structure of QR codes to encode phishing payloads—typically URLs leading to credential theft, malware, or other malicious outcomes. Modern attacks often exploit “fancy” QR code designs: non-standard color schemes, stylistic modifications, or embedded images that distort the canonical black-and-white module structure. Such codes are increasingly attractive to adversaries as they can bypass visual-based and URL-based detectors, subverting user expectations of QR code legitimacy (Akram et al., 11 Jan 2026).

The attack typically unfolds as follows:

• The attacker crafts a QR code with either a phishing URL or other harmful payload.
• The code is visually altered (e.g., colorized, stylized) to avoid automated defenses.
• The code is distributed physically (posters, packaging) or digitally (on screens, in advertisements).
• A victim scans the code, often with a default QR reader, and is misled into interacting with the malicious destination.

2. Visual Evasion Through Fancy QR Code Manipulation

Modern quishing variants increasingly use “fancy” QR codes that deviate from the standard high-contrast black-and-white grid. Modifications include:

• Arbitrary colorizations
• Artistic fill patterns and image overlays
• Selective distortion of alignment, finder, or timing patterns

These manipulations target visual-based (deep learning) QR scanners, which rely on learned features from typical QR code distributions. When the canonical structure is obfuscated, these models experience increased misclassification rates and diminished sensitivity to phishing payloads. Experimental results confirm that fancy QR codes consistently evade prevailing visual and URL-based countermeasures (Akram et al., 11 Jan 2026).

3. Safe-by-Design Detection: The ALFA Framework

The ALFA approach (“Anti-phishing Layer for Fancy QR Codes”) is a safe-by-design system for mitigating quishing, specifically targeting the post-scan detection of malicious fancy QR codes (Akram et al., 11 Jan 2026). The pipeline is as follows:

1. Preprocessing: The input QR image is thresholded using Otsu’s method and normalized to ensure a white background and dark modules.
2. Version and Module Extraction: The QR version is determined by comparing extracted format bits from the input to standard values. The image is segmented into $n \times n$ modules, where $n$ is the determined version-dependent side length.
3. Erroneous Module Detection: The binary module grid is scanned for discrepancies between scanned modules and ground-truth patterns (finder, alignment, separator, timing regions), identifying modules affected by visual manipulation.
4. FAST Correction: The FAST algorithm (Finder, Alignment, Separator, Timing) forcibly restores these canonical regions to standard values, mitigating the effects of styling on regions critical for QR decoding.
5. Feature Extraction: From the corrected binary grid, a 24-dimensional structural feature vector is computed, including protocol features (version, error correction, mask pattern, black/white module ratios) and statistical features (run-lengths, density variation, entropy, autocorrelation).
6. Classification: The feature vector is passed to a pre-trained XGBoost ensemble that predicts legitimacy using a logistic loss objective. The model is optimized via cross-validation, using regularization and parameter tuning to maximize AUC and F1.

The approach is platform-agnostic, supporting mobile deployment. The runtime characteristics (3.42 s per scan on modern mobile hardware) and storage footprint (72.5 MB) are suitable for on-device analysis.

4. Empirical Evaluation of Quishing Defenses

Evaluations on a synthetic set of 100 fancy QR codes (50 phishing, 50 legitimate) revealed the following (Akram et al., 11 Jan 2026):

• Without FAST, phishing detection (recall) is 94% (FNR 6%) but legitimate code specificity is low (FPR 68%).
• With FAST, false positive rate is reduced to 54%, with no loss in phishing recall.
• On real-world mobile devices, the ALFA prototype app achieved 90% recall (9/10 phishing codes detected), but only 40% specificity on legitimate samples.
• Commercial URL-based scanners achieve near-perfect specificity on original (undecorated) codes but detect only 20–50% of phishing payloads when QR codes are “fancy”.

Performance Table (extracted from experimental section):

Method	FNR (Phishing)	FPR (Legitimate)	Recall (mobile)	Spec. (mobile)
ALFA (No FAST)	6.0%	68.0%	90%	40%
ALFA (FAST)	6.0%	54.0%	90%	40%
Commercial URL-based QR readers	50-80%	~0%	20–50%	100%

ALFA thus lowers the false negative rate for phishing and achieves moderate specificity, outperforming both visual and URL-only defenses especially on stylized (“fancy”) attacks.

5. Classifier Architecture and Model Training

The ALFA classifier is a gradient-boosted decision tree ensemble (XGBoost) trained on feature vectors extracted from the corrected module grid:

• Input: 24 features, including categorical (one-hot encoded) and normalized statistical properties.
• Loss: Logistic loss (binary cross-entropy), for the binary Legitimate/Phishing classification.
• Optimization: Hyperparameters (learning rate, tree depth, ℓ₂ regularization) are tuned with Optuna.
• Validation: 5-fold stratified cross-validation on a synthetic dataset of fancy and canonical QR codes.

Reported hold-out accuracy reaches 98.7% (FNR 0.8%, FPR 1.2%) for black-white QR codes; on the more challenging fancy QR codes, the FNR/FPR trade-off is determined by the FAST-corrected feature extraction pipeline (Akram et al., 11 Jan 2026).

6. Limitations and Practical Implications

While the false negative rate for phishing detection is low (6%), the false positive rate on legitimate, stylistically-altered QR codes is higher (54–68%), though this is a marked improvement over deep learning and conventional URL defenses when subjected to fancy matrix manipulation. The ALFA approach is robust against evasion via stylistic alterations but may require further tuning to reduce the false positive rate for deployment in consumer-facing applications.

Key practical implications:

• Quishing via fancy QR code manipulation can systematically evade both visual and URL-based detection without specialized preprocessing and pattern correction.
• Structural-feature-based detection, combined with correction of canonical regions (FAST), provides an effective baseline for robust, on-device detection of quishing payloads.
• The outlined framework (ALFA) establishes a technical methodology for the future development and benchmarking of quishing mitigation solutions (Akram et al., 11 Jan 2026).