QUICK-RESPONSE CODE PHISHING DETECTION WITH IN-BROWSER REMEDIATION

1 . A method comprising:

intercepting a Hypertext Transfer Protocol (HTTP) response of a first web page intended for a web browser;

prior to communicating the HTTP response to the web browser, detecting a quick-response (QR) code in the first web page, wherein detecting the QR code comprises,

scanning the HTTP response to identify image data; and

detecting the QR code from the image data;

decoding the QR code to identify a second web page to which the QR code redirects;

obtaining characteristics of at least one of the first web page and the second web page; and

determining whether the QR code is malicious based, at least in part, on the characteristics of the first web page and the second web page.

2 . The method of claim 1 , wherein obtaining characteristics of the second web page comprises rendering the second web page in an isolated environment.

3 . The method of claim 2 , wherein rendering the second web page in the isolated environment comprises rendering the second web page and one or more additional web pages to which the second web page redirects in the isolated environment.

4 . The method of claim 2 , wherein the characteristics of the second web page comprise at least one of attempted uploads, attempted downloads, and attempted script executions that occurred during rendering of the second web page in the isolated environment.

5 . The method of claim 1 , further comprising, based on determining that the QR code is malicious, at least one of reporting the QR code as malicious and blocking the QR code from further access by the web browser.

6 . The method of claim 1 , wherein the characteristics of the second web page comprise a uniform resource locator (URL) of the second web page, wherein determining whether the QR code is malicious comprises determining whether the URL of the second web page is malicious.

7 . The method of claim 1 , further comprising replacing the QR code with a uniform resource locator of the first web page.

8 . The method of claim 1 , further comprising, based on determining that the QR code is malicious, at least one of,

masking the QR code in first web page; and

based on the web browser receiving a request for the second web page, rendering the second web page in a remote browser isolation environment.

9 . The method of claim 1 , further comprising:

determining that the QR code is benign, wherein determining that the QR code is benign comprises,

determining that the second web page does not comprise sensitive data; and

determining that the second web page and/or a uniform resource locator of the second web page have a security score below a threshold security score; and

based on determining that the QR code is benign, rendering the first web page in the web browser.

10 . A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to:

obtain a Hypertext Transfer Protocol (HTTP) response for a first web page intended for a web browser;

determine whether the HTTP response comprises a quick-response (QR) code;

based on a determination that the HTTP response comprises the QR code, suspend a session corresponding to the HTTP response;

identify a second web page to which the QR code redirects;

analyze characteristics of at least one of the second web page and the first web page to determine whether the QR code is malicious; and

based on a determination that the QR code is malicious,

perform one or more in-browser remediation actions for at least the first web page; and

resume the session corresponding to the HTTP response.

11 . The machine-readable medium of claim 10 , wherein the program code further comprises instructions to, based on a determination that the QR code is benign,

render the first web page in the web browser; and

resume the session corresponding to the HTTP response.

12 . The machine-readable medium of claim 10 , wherein the instructions to perform the one or more in-browser remediation actions for at least the first web page comprise instructions to at least one of,

remove the QR code from the first web page;

display at least one of a warning and a preview of the second web page in the first web page;

replace the QR code with a uniform resource locator of the second web page;

force the web browser to render the second web page in an isolated environment; and

mask the QR code in the first web page.

13 . The machine-readable medium of claim 10 , wherein the program code further comprises instructions to render the second web page in an isolated environment to obtain the characteristics of the second web page.

14 . The machine-readable medium of claim 10 , wherein the instructions to analyze the characteristics of at least one of the second web page and the first web page to determine whether the QR code is malicious comprise instructions to analyze the characteristics of at least one of the second web page and the first web page using data loss prevention analysis and security analysis.

15 . The machine-readable medium of claim 10 , wherein the program code further comprises instructions to,

determine a severity of risk associated with the QR code based, at least in part, on the characteristics of at least one of the second web page and the first web page; and

choose the one or more in-browser remediation actions to perform based, at least in part, on the determined severity.

16 . An apparatus comprising:

a processor; and

a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,

scan Hypertext Transfer Protocol (HTTP) responses intended for a web browser to detect quick-response (QR) codes; and

based on detecting a QR code in a first web page corresponding to an HTTP response in the HTTP responses,

suspend a session corresponding to the HTTP response until resolution of the QR code;

decode the QR code to identify a second web page to which the QR code redirects;

analyze characteristics of the QR code for sensitive data and security exposure to determine whether the QR code is malicious, wherein the characteristics of the QR code comprise at least one of characteristics of the first web page and characteristics of the second web page; and

based on a determination that the QR code is malicious, perform one or more in-browser remediation actions.

17 . The apparatus of claim 16 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to, subsequent to the instructions executable by the processor to cause the apparatus to perform the one or more in-browser remediation actions, resume the session corresponding to the HTTP response.

18 . The apparatus of claim 16 , wherein the machine-readable medium further has stored thereon instructions executable by the processor to cause the apparatus to render the second web page in an isolated environment to obtain the characteristics of the second web page.

19 . The apparatus of claim 18 , wherein the instructions to render the second web page in the isolated environment comprise instructions executable by the processor to cause the apparatus to render the second web page and one or more additional web pages to which the second web page redirects in the isolated environment.

20 . The apparatus of claim 16 , wherein the instructions to perform one or more in-browser remediation actions for at least the first web page comprise executable by the processor to cause the apparatus to at least one of, remove the QR code from the first web page;

display at least one of a warning and a preview of the second web page in the first web page;

replace the QR code with a uniform resource locator of the second web page;

force the web browser to render the second web page in an isolated environment; and

mask the QR code in the first web page.