skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-qr-code-phishing-with-email-security

Detect QR code phishing attacks that embed malicious URLs in email images.

954|172|Updated Mar 13, 2026
Search Tags:#OCR#threat detection#detection rules#SoC#email security#qr code phishing#quishing
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-qr-code-phishing-with-email-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-qr-code-phishing-with-email-security
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/phishing-defense/detecting-qr-code-phishing-with-email-security
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-qr-code-phishing-with-email-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

QR code phishing (quishing) bypasses traditional email security because malicious URLs are hidden inside images that text-based URL scanners cannot read, and victims scan them on unmanaged personal devices lacking corporate controls.

Core Features & Use Cases

  • Image-Based Detection: Configure email gateways to OCR and decode QR codes in inline images, PDF attachments, and ASCII-rendered variants, then submit extracted URLs to standard URL reputation and sandbox pipelines.
  • Evasion-Aware Rules: Detect split QR codes, nested QR codes, and ASCII text-rendered codes used by modern phishing kits to evade single-image decoders.
  • Mobile-Side Protection: Pair gateway decoding with MTD/MDM warnings so users are alerted before opening scanned URLs on personal devices.
  • Use Case: A SOC analyst investigating a wave of MFA-reset phishing emails uses this workflow to enable QR decoding at the gateway, build detection rules for image-only emails from first-time senders, and validate coverage with controlled quishing simulations.

Quick Start

Use this skill to build detection rules and a validation plan for QR code phishing emails targeting our organization.

Frequently Asked Questions about detecting-qr-code-phishing-with-email-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect QR code phishing in emails?▼

Configure the email security gateway to scan embedded images and PDF attachments for QR codes, decode them with OCR, and submit extracted URLs to the same reputation and sandbox pipeline as text URLs. Add rules flagging image-only emails from first-time external senders.

Why do traditional email filters miss quishing attacks?▼

Text-based URL scanners and Safe Links cannot read URLs embedded inside QR code images, so the malicious link never enters the scanning pipeline. The scan also typically happens on an unmanaged personal phone with no corporate proxy or filtering.

What evasion techniques do quishing attacks use?▼

Attackers use split QR codes divided across two benign-looking images, nested QR-in-QR codes, ASCII text-rendered QR codes that bypass image analysis entirely, styled codes with logos, and QR codes hidden inside PDF attachments rather than the email body.

Which tools support QR code detection in email security?▼

The skill references Barracuda Multimodal AI, Microsoft Defender for Office 365, Proofpoint TAP, and Palo Alto ALFA for QR decoding and safe scanning, plus Lookout or Zimperium for mobile threat defense on the scanning device.

How do I reduce false positives from QR code detection?▼

Legitimate marketing, event, and MFA-setup QR codes are the main false positive sources. Allowlist known-good senders rather than blocking all QR mail, and validate tuning by sending controlled test quishing across inline, SVG, split-image, PDF, and ASCII variants.

Related Skills

Explore More Software Engineering Skills→
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

yara-authoring

Write and test YARA rules to detect malware samples and threats.

Official
Intermediate
GhostPWNGhostPWN
4

CSOC Operations & Playbook Automation

Automate SOC alert triage and shift reporting with Python scripts.

Official
Advanced
Liberty91LTDLiberty91LTD
15

lookup-virustotal

Query VirusTotal for IP, domain, hash, and URL reputation reports.

Official
Intermediate
AcczdyAcczdy
2

implementing-hardware-security-key-authentication

Implements passwordless WebAuthn hardware key authentication with Python-fido2, Flask RP, and SQLite credential storage.

Community
Advanced