21.8% of phishing kits skip evasion entirely

A review of 1,300 phishing kits found 284 shipped with zero evasion functionality, per an analysis of kits collected between 2020 and 2023.

That's 21.8% of the sample with no attempt to dodge detection, in a category security teams tend to treat as endlessly adaptive.

The kits also lean on mainstream messaging services to move stolen credentials out, rather than building custom exfiltration infrastructure, per the analysis.

Components inside the kits are close to identical too, kit after kit, per the analysis. The analysis doesn't say whether that overlap comes from shared source kits or copied code circulating after leaks.

Phishing's reputation for constant reinvention doesn't match this sample. If the code and exfiltration channels are really this concentrated, targeting the messaging-app funnel could catch more than chasing kit variants one at a time. Watch whether takedown efforts start going after the messaging-service side instead.

This analysis made the August 10 briefing, examining phishing kits collected through 2023.