Characterizing Phishing Pages by JavaScript Capabilities
Researchers propose fingerprinting phishing kits by their JavaScript capabilities — exfiltration, evasion, mimicry — rather than relying on URL or visual similarity, offering defenders a more durable detection signal.
Summary written by editorial AI · Source link below
arXiv:2509.13186v2 Announce Type: replace Abstract: Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to rely on manual analysis to identify features for kit fingerprinting. In this paper, we examine the link between a page's client-side behavior and the underlying phishing kit used, enabling automated
Editorial Analysis
Framed for the Security Researcher desk
The paper shifts phishing analysis from URL or visual similarity to JavaScript-level capability fingerprinting, opening new avenues for automated kit classification and evasion-technique cataloguing.
Replicate the JavaScript-capability classification methodology on your own phishing corpus to assess its detection uplift compared to existing heuristics.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the Research Desk
- Is That Really My X-Ray? Measuring Internet-Exposed DICOM Services in the Presence of Deception20 Jul
- Intentional Electromagnetic Interference Attacks on Facial Recognition20 Jul
- DoSQ: A Cross-Layer Denial of Service Quality Attack by Exploiting Side Channels in 5G NR20 Jul
- Vogls: a Fast Interactive Full-timing Simulator for Pre-silicon Power Side-Channel Analysis20 Jul
- Central Bank Digital Currencies: Where is the Privacy, Technology, and Anonymity?20 Jul