Bots have gone phishing, but all they get is the boot
summary
Claim: phishing bots are cheap and scalable but can be made impractical by forcing them to run the real frontend and by raising extraction costs. Implementation: embed one-time tokens in front-end code, generate rotating polymorphic JS (polymorphic code obfuscation) and bind tokens to builds, add anti-debugging and anti-tamper checks. Result: demo shows a headless-browser attack still works without defenses but the approach forces use of a headless browser, increases attacker cost, and creates a detection window.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:06How do bot writers hurt you?
- 8:01Traditional detection techniques
- 18:01Phishing Bot Problem
- 31:46Giving the attacker the boot
- 47:41Main Takeaways
related talks
52mBreaking Fraud and Bot Detection Solutions
35mBreaking fraud & bot detection solutions
52mFlying Under the Radar - New Security Evasion Techniques
40mHostile JavaScript: Attacking and Defending the Browser
43mBypassing Malware Detection Mechanisms in Online Banking
53mProtecting Crypto Exchanges From A New Wave Of MitB Attacks
31mStrategies for Identifying and Mitigating Bot Threats
38mPhishing LLMs: Reeling in the Machine