Exemplifying Emerging Phishing: QR-based Browser-in-The-Browser (BiTB) Attack

2025-05-25

AI Summary

Current phishing defenses overlook the emerging threat of large language model (LLM)-enhanced social engineering, particularly in multi-stage, cross-modal attacks. Method: This work identifies and systematically analyzes a novel composite phishing attack—LLM-driven Quishing combined with Browser-in-the-Browser (BiTB)—where Google Gemini is leveraged for malicious prompt engineering to dynamically generate deceptive QR codes; these are then embedded via frontend iframe injection to seamlessly overlay spoofed interfaces within legitimate browser windows. Contribution/Results: We construct a fully reproducible attack chain demonstrating high user deception rates under realistic conditions. This study expands the phishing threat landscape by introducing the first empirically validated instance of LLMs being weaponized at the human–computer interaction layer for real-time, context-aware social engineering. The findings provide critical insights for designing next-generation anti-phishing mechanisms resilient to LLM-augmented, multi-vector threats.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Prompt Engineering / Prompting
• Computer Vision: Language and Vision

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work

Abstract

Lately, cybercriminals constantly formulate productive approaches to exploit individuals. This article exemplifies an innovative attack, namely QR-based Browser-in-The-Browser (BiTB), using proficiencies of Large Language Model (LLM) i.e. Google Gemini. The presented attack is a fusion of two emerging attacks: BiTB and Quishing (QR code phishing). Our study underscores attack's simplistic implementation utilizing malicious prompts provided to Gemini-LLM. Moreover, we presented a case study to highlight a lucrative attack method, we also performed an experiment to comprehend the attack execution on victims' device. The findings of this work obligate the researchers' contributions in confronting this type of phishing attempts through LLMs.

Problem

• Novel QR-based BiTB phishing attack exploiting LLMs
• Simplistic implementation using malicious LLM prompts
• Urgent need for defenses against LLM-assisted phishing

Innovation

• QR-based Browser-in-The-Browser attack
• Utilizes Large Language Model (Gemini)
• Combines BiTB and Quishing techniques