Characterizing Phishing Pages by JavaScript Capabilities
Researchers propose fingerprinting phishing kits by their JavaScript capabilities — exfiltration, evasion, mimicry — rather than relying on URL or visual similarity, offering defenders a more durable detection signal.
Summary written by editorial AI · Source link below
arXiv:2509.13186v2 Announce Type: replace Abstract: Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to rely on manual analysis to identify features for kit fingerprinting. In this paper, we examine the link between a page's client-side behavior and the underlying phishing kit used, enabling automated
Editorial Analysis
Phishing remains the top initial-access vector for European enterprises; capability-based detection could outlast the short shelf-life of domain-based blocklists.
Share the JavaScript-capability taxonomy with your email-security and web-proxy vendors to evaluate coverage gaps.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the Research Desk
- Is That Really My X-Ray? Measuring Internet-Exposed DICOM Services in the Presence of Deception20 Jul
- Intentional Electromagnetic Interference Attacks on Facial Recognition20 Jul
- DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR20 Jul
- Vogls: a Fast Interactive Full-timing Simulator for Pre-silicon Power Side-Channel Analysis20 Jul
- Central Bank Digital Currencies: Where is the Privacy, Technology, and Anonymity?20 Jul