WebView-Based Hybrid Analysis of Link and Event for On-Device QR Phishing Detection Framework

Area of Science:

• Cybersecurity
• Mobile Security
• Phishing Detection

Background:

• Quishing, or QR code phishing, poses a significant threat to mobile users by exploiting QR code scanning to steal credentials.
• Advanced quishing variants evade detection by delaying malicious activity until after user interaction.

Purpose of the Study:

• To propose WHALE (WebView-Based Hybrid Analysis of Link and Event), an on-device framework for detecting QR code phishing attacks.
• To enhance mobile security by providing a robust defense against sophisticated quishing tactics.

Main Methods:

• WHALE employs a multi-stage detection process using an isolated Sandbox WebView to analyze QR-decoded URLs.
• A static analysis stage extracts URL and DOM features for initial risk scoring.
• A dynamic analysis stage simulates user interaction with decoy credentials to observe credential-flow behavior.

Main Results:

• The static model achieved 93.86% accuracy, while the dynamic model reached 91.5% accuracy.
• WHALE demonstrated practical mobile overhead with low runtime and model size on real devices.
• The framework effectively detected QR-based phishing threats while minimizing user credential exposure.

Conclusions:

• WHALE provides an effective on-device solution for detecting quishing attacks in mobile environments.
• The hybrid static and dynamic analysis approach enhances the robustness of phishing detection.
• Sandboxed credential-flow analysis is crucial for mitigating risks associated with quishing.