Dual-Module QR Codes: Bypassing QR Code Scanners in Enterprise Email Gateways

QR Code detection engines in email security solutions suffer from a common problem: the most commonly used method for decoding QR Codes is simple and predictable. By exploiting the decoding algorithm and leveraging existing QR data-layering techniques, this research provides the security industry with a working proof-of-concept to bypass email security gateway detection systems. This method is also effective against mobile applications, such as camera and QR Code applications, as well as open-source libraries used to decode QR Codes.

Furthermore, the proposed technique does not require the attacker to hide the QR Code from automated detection; instead, it presents the malicious payload in plain sight, masquerading as a legitimate QR Code containing a benign URL. Recommendations to detect and prevent this attack vector include context simulation and visual AI analysis.