We are fighting phishing at the wrong layer
Summary
Attackers can set up phishing sites within 24 minutes by registering a domain and serving a live credential-harvesting page. Traditional defenses focus on blocking domains, which are cheap and easily replaced, rather than the more persistent and costly servers. Modern phishing kits employ adversary-in-the-middle (AitM) proxies to relay traffic to legitimate services, making them harder to detect and allowing attackers to steal credentials and session tokens.
IFF Assessment
This article highlights advanced phishing techniques that bypass traditional defenses, posing a significant threat to organizations.
Defender Context
Defenders need to shift their focus from blocking domains to identifying and disrupting the underlying infrastructure used by sophisticated phishing attacks, such as adversary-in-the-middle proxies. Techniques like monitoring certificate transparency and analyzing network traffic for unusual patterns can help detect these operations before they lead to widespread compromise.