AI-powered phishing is leaving blocklists behind

Phishing domains are disappearing faster than blocklists can track them. According to security company Push Security, 89% of phishing domains remain active for fewer than two days, while only 6.5% survive beyond 15 days. By the time a domain is identified and added to a blocklist, the campaign may already have moved to new infrastructure.

That gap is widening as attackers use AI to build convincing phishing pages from screenshots, generate entirely new codebases, and rapidly deploy and dismantle campaigns. The result, Push argues, is that defenses based mainly on known malicious domains, URLs, or file hashes are becoming structurally less effective.

The shift matters beyond traditional email phishing. The company’s examples include adversary-in-the-middle (AiTM) attacks, device-code phishing, ClickFix campaigns, file downloads, and malvertising. These attacks increasingly appear inside legitimate browser sessions and services, where conventional network and endpoint tools may have limited visibility.

The trend adds to the problems facing defenders already dealing with AI-written lures, OAuth abuse, and fake support interactions. Recent phishing campaigns are harder to spot, and even multifactor authentication is no longer a guarantee of safety when attackers target authenticated sessions or legitimate login flows.

Recommended reading

Horizon3 raises $250 million at $2 billion valuation

Why disposable phishing infrastructure defeats blocklists

Modern campaigns are not simply replacing infrastructure after detection. Push says attackers are designing it to be disposable from the beginning, treating each domain or page as effectively single-use.

Attackers also combine widely trusted hosting and productivity services with layers intended to frustrate analysis. Services cited by Push include Cloudflare Workers, Railway, Vercel, Microsoft Dynamics, SharePoint, Adobe, Google Firebase, Google Sites, Jotform, Linode, Azure, and Atlassian.

Bot protection, referrer checks, browser fingerprinting, and redirect chains can prevent automated scanners and researchers from seeing the same content as a victim. Push reports that 95% of the in-browser attacks it detects use some form of bot protection. A page may display harmless content to a crawler, show a phishing flow to a real user, and disappear before investigators can inspect its payload.

AI has also reduced the effort required to clone a legitimate login page. Attackers can use a screenshot to “vibe-code” a phishing site whose frontend looks authentic but whose underlying code shares little or nothing with the original. That makes static detection based on familiar HTML or JavaScript patterns harder.

Delivery is shifting, too. Push says attackers are abusing legitimate services such as AI chatbot sharing features, search advertising, in-app messaging, and application-generated emails. Those channels inherit the reputation of platforms that blocklists are unlikely to classify as malicious.

Phishing kits are fragmenting faster than signatures can adapt

Blocklists are not the only detection layer under pressure. Security teams have traditionally moved higher up the Pyramid of Pain by identifying reusable phishing-kit fingerprints, including JavaScript structure, HTML patterns, and code signatures. A detection based on a kit could survive a domain change and catch multiple campaigns.

Push says that layer is now eroding through code forking, AI-assisted development, and open-source-style sharing. Device-code phishing illustrates the acceleration: after emerging in Russia-linked campaigns in 2024, it grew from zero criminal kits in the wild to more than 25 distinct kits by 2026, according to the company.

Named examples include EvilTokens, which Push says targeted more than 340 organizations in its first five weeks, as well as Kali365, ARToken, DEBULL, and Forg365. The FBI issued an advisory about Kali365, while established AiTM provider Tycoon 2FA has added device-code phishing to its existing credential-harvesting capabilities.

Push says some kits can choose between attack methods based on a target’s behavior—for example, trying device-code phishing first and switching to AiTM if the flow times out. Admin panels can control when a malicious page appears, sometimes activating it only after an attacker has begun a related voice-based social-engineering interaction. That makes the page less likely to be observed often enough for a preemptive block.

×

Behavioral detection targets the attack, not its domain

The more durable target is the technique itself: the behavior that remains consistent even when domains, frontends, and toolkits change.

In an AiTM attack, for example, the attacker proxies the victim’s session through attacker-controlled infrastructure, relays credentials and MFA tokens in real time, and captures the authenticated session. Push says it is tracking more than 75 AiTM kits, but their implementation of that interception technique remains fundamentally similar.

ClickFix campaigns use different lures—including fake CAPTCHAs, browser updates, and error dialogs—but the underlying behavior is consistent: the victim is persuaded to place malicious commands on the clipboard and paste and execute them. CrowdStrike has reported that fake-CAPTCHA lures increased by 563%, according to Push.

Device-code phishing likewise relies on a legitimate device-code login process. The hosting location and kit may vary, but the destination page and the user’s authentication behavior are the same.

That approach requires visibility inside the browser. Network proxies generally see encrypted traffic, while endpoint detection and response tools may not observe what happens in a browser session. It also requires rapid research: Push says device-code phishing took roughly a year to move from a nation-state novelty to a commodity phishing-as-a-service feature.

A detection that did not rely on known indicators

Microsoft previously documented a phishing technique that abused OAuth error-handling redirects. The attack used standards-compliant redirect behavior to send users from a trusted identity-provider domain to an attacker-controlled page, initially giving the link the reputation of login.microsoftonline.com.

Push says its agentic threat-hunting pipeline—AI agents working alongside human researchers—studied the behavioral mechanics rather than Microsoft’s published indicators. The pipeline operates across browser telemetry from more than 3 million deployments and created a detection for the OAuth redirect behavior.

Months later, the detection triggered on a different campaign involving different lures, domains, infrastructure, and an unfamiliar phishing kit. The payload was also different: a malware download rather than the original campaign’s technique. None of the original indicators of compromise appeared in the attack chain.

×

Push says the same process produced detections for three additional browser-based techniques: InstallFix, which disguises malware delivery as software-installation prompts; ConsentFix, which combines OAuth-consent phishing with ClickFix-style manipulation; and LLMShare, which delivers malware through AI chatbot sharing features.

The company says its pipeline protected more than 60 customers during the last three months from novel phishing techniques, intercepting roughly 225 threat instances before account compromise or malware interaction occurred. Those figures are Push’s own results, not an independent benchmark, and the company is also the vendor behind the sponsored article.

The facts point to a clear defensive priority: infrastructure and kit signatures can still help, but they decay quickly when AI makes campaigns cheap to rebuild. Behavioral detections are harder to rotate away from—but only for security teams that can see browser activity and turn newly discovered techniques into protections before they become commodity features.