How Cloudflare Cloud Email Security protects against the evolving threat of QR phishing
This post details Cloudflare's evolution in detecting and mitigating quishing (QR phishing) attacks. It explains how quishing bypasses traditional URL/attachment-based detection by embedding malicious links within QR codes, which require a computer vision engine to scan. Cloudflare's approach involves two parts: 1) QR code detection and scanning using specialized heuristics and computer vision models, and 2) analysis of decoded QR codes using existing phishing detection engines, URL deconstruction, attachment scanning, and decryption capabilities. The post highlights the challenges of obfuscated QR codes and the need for continuous updates to detection tools. It also discusses overcoming CAPTCHAs and conditional blocks in redirect chains using specialized tools and ML models for link reputation analysis. Real-world examples of quishing attacks impersonating Microsoft and DocuSign are provided.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack