Catching Transparent Phish: Understanding and Detecting MITM Phishing Kits
summary
Claims that MITM phishing kits steal credentials and 2FA in real time, demonstrated using evil Gen X, Moran and moglishka and a working demo. Detection relies on network-timing and TLS fingerprinting, not page content. A crawler+classifier finds ~1200 kits in a year, 1200 kits discovered, many on popular cloud hosts, and only 43.7% of domains appear on blocklists by the end of collection. The authors build FOCA and report high classifier accuracy and real-world hits.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:20The Value of Stolen Data
- 5:07Anatomy of a Traditional Phishing Attack
- 8:18Limitations of Traditional Phishing
- 10:07Man-in-the-Middle (MITM) Phishing Toolkits
- 18:51MITM Phishing Toolkit Threat Model
- 21:42Network-Level Phishing Detection
- 23:36Network Timing Analysis
- 30:27MITM Phishing Toolkit Groundtruth
- 32:42MITM Phishing Toolkit Classifier
- 43:12MITM Phishing Toolkits on the Web
- 45:29MITM Phishing Domain Types
- 46:11MITM Phishing Website Lifecycle
- 48:54Case Study: Palo Alto Networks
- 50:21Server-side TLS Fingerprinting
- 52:08Countermeasures
- 53:09Conclusion
related talks
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
40mMy Phishing Kit Burnbook
49mThe Death of Conventional MFA: How AiTM Attacks Are Changing the Game
38mTeach a Man to Phish and You Feed Him for a Lifetime
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
27mCatching the Phisherman
52mBreaking Fraud and Bot Detection Solutions
06mSoK: Still Plenty of Phish in the Sea — A Taxonomy of User-Oriented Phishing