WebView-Based Hybrid Analysis of Link and Event for On-Device QR Phishing Detection Framework

Quishing, a form of phishing conducted through QR codes, has emerged as a critical threat to user information security in mobile environments. Quishing attacks exploit the QR scanning workflow by opening malicious URLs in WebView and impersonating legitimate services to steal user credentials. Recent variants further evade static inspection by exposing credential-harvesting behavior only after user interaction, form submission, redirection, or page-state changes. In this paper, we propose WebView-Based Hybrid Analysis of Link and Event for On-Device QR Phishing Detection (WHALE), an On-Device multi-stage phishing detection framework based on an isolated Sandbox WebView. WHALE first loads the QR-decoded URL into the Sandbox WebView instead of directly delivering it to the User WebView, thereby separating the analysis process from the user session. In the static stage, WHALE extracts 54 features from the URL string, initial HTML, and DOM snapshot, and computes a static phishing risk score using a lightweight model. Inputs with uncertain static scores are forwarded to the dynamic stage. In the dynamic stage, WHALE inserts decoy credentials instead of real user credentials, triggers a controlled submit event, and analyzes 59 credential-flow state-transition features extracted before and after submission. The static model achieved an accuracy of 93.86%, precision of 93.08%, recall of 94.78%, and F1-score of 93.92%. The dynamic model achieved an accuracy of 0.915, precision of 0.895, recall of 0.946, specificity of 0.882, and F1-score of 0.920 on a source-group-disjoint independent test set. Real-device evaluation on a Samsung Galaxy S23 Ultra showed that WHALE maintains practical mobile overhead, with an average static internal runtime of 58.75 ms, dynamic internal runtime of 4165.42 ms, combined model inference time of 0.088 ms, and model asset size of 0.681 MB. These results demonstrate that WHALE can detect QR-based phishing threats On-Device while reducing user credential exposure through sandboxed credential-flow analysis.