Analysis of 1,300 phishkits finds 21.8% lack evasion tactics

A new arXiv paper by Behzad Ousat, Mohammad Ali Tofighi, Estefan Schafir, and Amin Kharraz dissects the architecture and operational behavior of 1,300 phishkits collected between 2020 and 2023. Phishkits are pre-packaged toolkits that let attackers quickly deploy convincing phishing pages, avoid detection, and maintain backdoors to exfiltrate stolen credentials. The researchers performed deep source code analysis, examining communication channels, evasion mechanics, and the types of data transmitted to adversaries.

Their findings reveal a heavy reliance on current messaging services—like Telegram—for exchanging stolen data, alongside dynamic redirection and incoming traffic attribution as key cloak-and-dagger techniques. Surprisingly, only a small minority of kits show advanced features: 284 (21.8%) use no evasion mechanisms at all. Moreover, while implementation details differ, core components across kits are remarkably similar, with extensive code reuse and known tricks dominating. This predictability, the authors argue, makes large-scale detection of phishing operations significantly easier. For security teams, the study offers practical leads: focusing on shared code signatures and messaging-service callbacks could dramatically improve phishing defense at scale.