1,300 Phishkits Dissected: 21.8% Ship With No Evasion at All, and Code Reuse Makes Most of Them Predictable

arXiv 2608.07451·medium signalXBlueskyLinkedInCopy link

An analysis of 1,300 modern phishkits collected from 2020 to 2023 examined architecture, source code, communication channels, and the nature of data exfiltrated to operators, identifying dynamic redirection and traffic-attribution mechanisms used for cloaking plus heavy reliance on mainstream messaging services for moving stolen credentials. The headline counter-narrative: only a small minority carry advanced functionality, and 284 kits (21.8%) implement no evasion whatsoever. Because the components keeping phishing pages functional are near-identical across kits, the authors argue large-scale detection is more tractable than the threat's reputation suggests.