A systematic literature review on deep learning approaches for QR code-based phishing (quishing) detection: emerging attack vectors, multimodal feature fusion and open research challenges

Phishing attacks using QR codes have evolved into a unique and exponentially increasing cyber security threat that circumvents traditional email filtering systems, browser blacklists and URL classification algorithms by embedding malware code into an optical matrix format. This paper reports a comprehensive review of the existing literature regarding the deep learning techniques used in detecting quishing attacks, with 41 scholarly articles included from 2021–2026. A four-stage method is adopted for the reviewed studies, comprising a search in primary databases, screening using keywords, selection based on the quality criteria and systematic extraction of data, using models such as Convolutional Neural Networks (CNNs), Vision transformers (ViT), Long short-term memory networks (LSTMs), Bidirectional encoder representations from transformers (BERT), Generative adversarial networks (GANs) and Graph neural networks (GNNs), which are classified into three detection architectures such as pre-decode QR image analysis, post-decode URL classification and multimodal fusion. While quantitative performance evaluation reveals accuracies between 99.81% and 83.18%, the comparability of different studies is hampered by the use of private laboratory datasets. A critical assessment along with seven criteria viz model architecture, feature representation, generalisability of the dataset, adversarial attack resilience, real-time performance, evaluation approach and explainability finds five limitations hindering practical applicability, with six research areas recommended for future research.