AI-Powered Phishing and Disposable Infrastructure Render Blocklists Obsolete

Traditional domain blocklists and static signature databases are no longer capable of keeping pace with modern phishing campaigns. As detailed in new research from Push Security, the combination of generative AI, automated infrastructure rotation, and bulletproof reverse-proxies has fundamentally undermined the effectiveness of indicator-based network defenses. Modern phishing infrastructure is now engineered to be disposable by default, with 89% of malicious domains remaining active for fewer than two days and just 6.5% surviving past 15 days. By the time an indicator is identified, analyzed, and added to a domain blocklist or secure web gateway (SWG), attackers have already burned the domain and moved to a fresh target environment.

The Industrialization of PhaaS and Disposable Infrastructure

The rapid decay of traditional blocklists stems from a structural evolution in how Phishing-as-a-Service (PhaaS) platforms operate. Rather than waiting to be discovered and pivoting reactively, modern threat actors proactively spin up and tear down single-use pages. Attackers routinely abuse high-reputation hosting platforms and serverless providers—including Cloudflare Workers, Railway, Vercel, Microsoft Dynamics, SharePoint, Google Firebase, Google Sites, Adobe, Atlassian, and Linode—allowing malicious infrastructure to inherit domain trust that network filters cannot easily block without causing widespread enterprise disruption.

To further evade automated crawlers and security sandboxes, 95% of in-browser attacks detected by Push Security deploy bot protection, browser fingerprinting, and referrer checks. Security scanners see benign landing pages or dead links, while genuine targets are routed through dynamic redirect chains.

Furthermore, generative AI has eliminated the visual cloning bottleneck. Threat actors can now “vibe-code” complete phishing frontends directly from a screenshot of a target login portal. This generates unique HTML and JavaScript codebases for every iteration, neutralizing static fingerprinting and pattern matching. Combined with delivery channels that leverage trusted platforms—such as AI chatbot sharing features, search engine ad placements, and automated in-app notifications—malicious links bypass traditional email and network filtering controls.

Kit Proliferation: From AiTM to Device Code Phishing

Historically, security teams relied on fingerprinting the middle tiers of David Bianco’s Pyramid of Pain by identifying distinct JavaScript variables, file structures, or server headers across phishing kits. However, open-source code sharing, kit forking, and AI-assisted development have fragmented the tooling ecosystem faster than defenders can track.

Device code phishing illustrates this rapid commoditization curve. First observed in targeted Russian state-sponsored campaigns in 2024, the technique has rapidly scaled into mainstream cybercrime. At least 25 distinct device code kits are currently active in the wild, driven by commercial PhaaS offerings such as EvilTokens (which compromised over 340 organizations in its first five weeks), Kali365 (subject of an FBI security advisory), ARToken, DEBULL, and Forg365.

Established Adversary-in-the-Middle (AiTM) vendors like Tycoon 2FA have integrated device code harvesting into their existing platforms. Operators can dynamically alter payloads based on victim behavior—such as attempting device code phishing first, then automatically falling back to real-time credential proxying if the session times out. Managed via attacker-operated admin panels and combined with live voice-based social engineering (vishing), these payloads are often toggled on only during live interactions, preventing automated detection platforms from observing the malicious behavior beforehand.

Behavioral Mechanics: Why Technique-Based Detection Endures

While domains, IP addresses, and source code rotate continuously, the underlying behavioral mechanics of modern identity attacks remain constrained by protocol design. Detecting attacks at the technique level targets what is hardest for an adversary to alter:

• Adversary-in-the-Middle (AiTM) Interception: Frameworks like Evilginx, Tycoon 2FA, and Sneaky 2FA (among more than 75 active variants tracked by researchers) function by proxying traffic live between the target and the real identity provider. While the frontends and proxy IPs constantly shift, the core behavior—interception and relaying of real-time MFA tokens and session cookies—remains identical.
• OAuth Device Code Abuse: Exploiting the OAuth 2.0 Device Authorization Grant (RFC 8628), attackers induce targets to enter a user-code on a legitimate authentication portal (e.g., Microsoft or Google). Because the victim authenticates directly on the trusted domain, traditional web filters see no malicious destination, yet the attacker’s client application receives the final OAuth tokens, bypassing multi-factor authentication entirely.
• ClickFix Execution Chains: Lures leveraging fake CAPTCHAs (which CrowdStrike reports have spiked by 563%), browser update prompts, or system error dialogs all rely on convincing the user to copy malicious commands into their system clipboard and manually execute them via native interpreters like the Windows Run prompt (Win+R) or terminal windows.

Because developing entirely new attack techniques requires human research and protocol discovery, behavioral signatures built around these core mechanics survive infrastructure rotation and tool fragmentation.

Shifting Defenses to the In-Browser Execution Layer

Defending against AI-accelerated phishing campaigns requires shifting visibility away from static indicators and edge proxies toward the browser execution context where these interactions actually occur.

• Deploy In-Browser Detection Capabilities: Because AiTM reverse-proxies negotiate encrypted TLS connections directly with the victim and host-based EDRs lack visibility into internal browser DOM events, organizations must implement browser-level telemetry capable of inspecting live DOM manipulation, clipboard actions, and dynamic redirect behavior at the moment of user interaction.
• Enforce Phishing-Resistant MFA: Transition from push notifications, SMS, or TOTP codes to FIDO2 / WebAuthn standards (such as hardware security keys or platform authenticators like Windows Hello and Touch ID). FIDO2 cryptographically binds the authentication response to the origin domain in the browser address bar, rendering AiTM proxy credential relaying useless.
• Disable Unused OAuth Device Authorization Grants: Restrict or conditionally block the OAuth 2.0 Device Flow across your Identity Provider (IdP) for standard workers who do not require authentication on input-constrained devices, eliminating the device code attack surface.
• Detect Clipboard Manipulation and Host Scripting: Configure endpoint security rules to monitor and alert when web browsers attempt to write encoded commands (such as Base64-encoded PowerShell execution strings) to the system clipboard, or when native shells (powershell.exe, cmd.exe) are launched directly following a web browsing session.