An Analysis of Architectural and Operational Dynamics of Phishkits in the Wild
2026-08-07 • Cryptography and Security
Cryptography and SecurityNetworking and Internet ArchitectureSocial and Information Networks
AI summaryⓘ
The authors studied 1,300 phishing toolkits called phishkits from 2020 to 2023 to understand how attackers build and use fake web pages to steal information. They found that many phishkits use tricks to hide themselves and send stolen data, often using popular messaging services. However, most phishkits have simple designs and reuse a lot of the same code and methods, making them somewhat predictable. This suggests it might be easier to detect these phishing attacks on a large scale than previously thought.
phishingphishkitsevasion mechanismsdynamic redirectioncloakingsource code analysisdata exfiltrationmessaging servicescode reusecybersecurity
Authors
Behzad Ousat, Mohammad Ali Tofighi, Estefan Schafir, Amin Kharraz
Abstract
Phishing attacks have always been a favored vector for adversaries to defraud users, bypass modern defense mechanisms, and penetrate critical systems. Among all the elements contributing to the creation and deployment of successful phishing attacks, phishkits stand out as a crucial parameter. Phishkits often facilitate creating and deploying compelling phishing pages, implement evasion strategies, and establish and maintain backdoors with remote adversaries for exchanging leaked data. In this work, we performed an analysis of 1,300 modern phishkits collected from 2020 to 2023. We analyzed the architecture, source code, communication channels, and the nature of leaked data shared with adversaries. We identified mechanisms for dynamic redirection and attributing incoming web traffic as part of the evasion and cloaking mechanism. We also observed heavy reliance on current messaging services for exchanging stolen data with phishers. That said, our analysis shows that the number of phishkits with advanced functionalities is quite small. We identified 284 (21.8%) phishkits that did not use any form of evasion mechanism. We also observed that while there were differences in the implementation details of phishkits, the major components that keep phishing pages functional were very similar or even identical across kits. The level of code reuse and heavy reliance on known tricks to build pre-packaged phishing pages make a large number of cases predictable, which can potentially make the detection of these adversarial operations even easier at scale.