Phishing attacks modifications and evolutions

Abstract

So-called “phishing attacks” are attacks in which phishing sites are disguised as legitimate websites in order to steal sensitive information. Our previous research [1] showed that phishing attacks tend to be relaunched many times, after sometimes small modifications. In this paper, we look into the details of these modifications and their evolution over time. We propose a model called the “Semi-Complete Linkage” (SCL) graph to perform our evaluation, and we show that unlike usual software, phishing attacks tend to be derived from a small set of master versions, and even the most active attacks in our database only go through a couple of iterations on average over their lifespan. We also show that phishing attacks tend to evolve independently from one another, without much cross-coordination.