Push Security Argues AI-Powered Phishing Is Outpacing Blocklists
Summary
Push Security argues that AI-generated phishing, fast-rotating infrastructure and fragmented kits undermine blocklists, advocating browser-session visibility and technique-level detection. Its examples and customer-protection figures are vendor claims.
Key points
- Push Security says 89% of phishing domains remain active for fewer than two days, limiting the usefulness of blocklists.
- The company reports that 95% of in-browser attacks it detects use bot protection, often with referrer checks or browser fingerprinting.
- The article argues that behavioral detection of techniques such as AiTM, ClickFix and device code phishing can outlast changes in domains and phishing kits.
- Push describes a detection based on OAuth redirect behavior that later alerted on a different campaign with no overlap in the original indicators; this is the vendor's account.
- Push says its pipeline also led to detection of InstallFix, ConsentFix and LLMShare, and claims it protected 60+ customers and intercepted about 225 threat instances in three months.
- The article says technique-level detection requires visibility into browser sessions and research that can keep pace with techniques moving into criminal toolkits.
Article Details
- Topic
- AI-assisted phishing, rapidly rotating infrastructure, and browser-based behavioral detection
People
Vendors
Tools
ARTokenCriminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability.DEBULLCriminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability.EvilginxEvery AiTM kit — Tycoon, Sneaky 2FA, Evilginx, or countless forks and derivatives (we’re tracking 75+ kits in the wild) implements fundamentally the same interception technique: proxy the victim's session throughEvilTokensCriminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability.Forg365Criminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability.Kali365Criminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability.Sneaky 2FAEvery AiTM kit — Tycoon, Sneaky 2FA, Evilginx, or countless forks and derivatives (we’re tracking 75+ kits in the wild) implements fundamentally the same interception technique: proxy the victim's session throughTycoonEstablished AiTM vendors like Tycoon 2FA have added device code phishing alongside their existing credential-harvesting capabilities, and we’ve recently observed kits dynamically switching between payloads depending onTycoon 2FAEstablished AiTM vendors like Tycoon 2FA have added device code phishing alongside their existing credential-harvesting capabilities, and we’ve recently observed kits dynamically switching between payloads depending on