Exposing QR-Code Phishing Attacks Through ZBar-Based QR Scanning Using Convolutional Neural Network Threat Classification

QR codes are widely used to provide quick access to websites, authentication pages, payment services, application resources, documents, and other online destinations. Because the actual destination is encoded inside the QR image, a user may not know where the QR code will lead before it is scanned and decoded.

QR-code phishing, commonly referred to as quishing, abuses this characteristic by embedding a deceptive or malicious destination inside a QR code. An attacker can distribute such QR codes through documents, images, posters, messages, or other delivery channels. When the QR code is scanned, the user may be redirected to a phishing resource that attempts to obtain sensitive information.

In this use case, a controlled QR-code phishing detection environment is implemented using a ZBar-based QR scanning workflow. A public QR-code security dataset is used to train and validate a Convolutional Neural Network (CNN) for QR-code threat classification.

The controlled attack is performed only inside an isolated Ubuntu and Kali Linux laboratory environment. A laboratory-only phishing destination is encoded into a QR code and introduced into the scanning workflow. ZBar is used to decode the QR payload, while the CNN provides the AI-based threat classification.

Public QR-Code Security Dataset → QR Image Preprocessing → CNN Model Training → CNN Validation → Controlled Phishing Destination → Phishing QR Code Generation → QR Code Introduction → ZBar Decoding → CNN Threat Classification → Security Decision → Suspicious QR Code Identification

Application : ZBar-Based QR Scanning Environment

ZBar provides QR-code and barcode decoding functionality and can identify information encoded inside a QR image, such as a URL or text payload.

However, QR decoding and QR security classification are separate functions. A QR scanner may successfully decode a QR code without determining whether the destination represented by the QR code is legitimate or associated with phishing activity.

A malicious QR code can visually appear similar to a legitimate QR code. A user may therefore scan the QR code without knowing that the encoded destination is deceptive.

In a conventional QR-scanning workflow, the primary operation is decoding the information contained inside the QR image.

The proposed solution introduces an AI-based QR-code threat-classification layer into the QR-scanning workflow. The CNN is trained using a public QR-code security dataset and is used to classify submitted QR-code samples. ZBar provides the QR-decoding capability required to expose the embedded destination for additional security validation.

Specific Attack : QR-Code Phishing Attack

The controlled QR-code phishing attack introduces a QR code containing a laboratory-only phishing destination into the isolated security-testing environment.

The attack does not target a real user, production application, or external phishing infrastructure. Instead, a controlled phishing-style destination is created inside the laboratory and encoded into a QR code.

The generated QR code is then introduced into the QR-scanning workflow. The submitted QR image is analyzed by the trained CNN, while ZBar decodes the information encoded inside the QR code.

AI-Assisted QR-Code Threat Classification and Pre-Access Validation

The security concept introduces an AI-based classification layer into the QR-scanning process so that QR-code security characteristics can be evaluated before the decoded destination is treated as trusted within the controlled environment.

The CNN learns classification patterns from the public QR-code security dataset. During detection, a submitted QR-code image is processed using the same preprocessing pipeline used during model training.

ZBar performs the complementary QR-decoding function and exposes the information encoded inside the QR code.

The security concept defines the overall security strategy.

The following are the specific defensive mechanisms implemented.

The submitted QR-code image is processed using the trained CNN model. The model extracts learned image characteristics and produces the security classification associated with the QR-code sample.

The QR-code phishing attack is successfully reproduced inside an isolated Ubuntu and Kali Linux security-testing environment without targeting real users or external production systems.

A public QR-code security dataset is processed and used to train and validate the Convolutional Neural Network for QR-code threat classification.

The CNN learns classification patterns from the available labelled QR-code image data and produces security predictions for previously unseen QR-code samples.

The ZBar-based QR-scanning workflow successfully decodes the information embedded inside the submitted QR-code samples.

The controlled phishing destination is successfully embedded into a QR code and introduced into the laboratory detection workflow as a known attack condition.

The CNN classification and ZBar payload-decoding results provide complementary security information for evaluating the submitted QR code.

The implemented workflow can classify tested QR-code samples and compare the resulting predictions against the known laboratory ground truth.

Repeated testing with benign and controlled phishing QR-code samples provides measurable evidence for accuracy, false-positive, and false-negative analysis.

The implementation demonstrates how an AI-based threat-classification layer can be integrated with an existing QR-decoding workflow to provide additional security validation.

The final result is a repeatable laboratory-based QR-code phishing detection workflow that can be further evaluated, optimized, and integrated into a broader QR-code security solution.