Pith. sign in

REVIEW 3 major objections 2 minor 91 references

I can't recognize (yet): Delayed Rendering to Defeat Visual Phishing Detectors

T0 review · 3 major / 2 minor · reviewed 2026-05-09 · grok-4.3

Challenge this review Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Visual phishing detectors can be defeated by delaying the rendering of key webpage elements until after the snapshot is taken.

desk verdict The paper shows a timing trick can defeat visual phishing detectors by hiding elements until after the snapshot, but only if the tested systems actually capture early. read the letter →

arxiv 2605.00183 v1 submitted 2026-04-30 cs.CR

Ying Yuan , Cristiano Alex Rado , Giovanni Apruzzese , Mauro Conti , Luigi Vincenzo Mancini This is my paper · ORCID
classification cs.CR
keywords phishingdetectionvisualevasiondelayedrenderingtimingattacksmachinelearningsecuritywebpagesnapshotscurtaineffectsuserstudy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper shows that machine-learning visual detectors for phishing sites overlook a simple timing vulnerability in how they inspect pages. Attackers delay the appearance of distinctive parts like logos so the detector captures an incomplete view and classifies the page as legitimate. This tactic uses basic techniques such as curtain effects and drops detection rates from 100 percent to zero. A user study confirms that people do not reliably notice the delays and still fall for the pages. The authors also outline client-side mitigations that do not require external services.

What carries the argument

Delayed rendering of key webpage elements such as logos, achieved through problem-space techniques like curtain effects, which prevents the detector's single snapshot from capturing the phishing indicators.

What would settle it

If a detector is modified to take its snapshot only after the full page has rendered or after monitoring for late-arriving elements, and it then correctly flags the delayed phishing pages, the vulnerability claim would be refuted.

Watch

Extended reading notes

Core claim

The paper establishes that visual similarity detectors for phishing must take a snapshot of the target page before comparing it to known legitimate sites, and that attackers can exploit this by deliberately delaying the rendering of key phishing elements such as logos. When the snapshot occurs before these elements appear, the detector sees only benign content and misclassifies the page. Empirical tests show state-of-the-art systems can be reduced to zero detection rate with low-cost problem-space methods like curtain effects, and a user study finds the changes remain imperceptible to humans.

Load-bearing premise

Visual phishing detectors rely on taking one static snapshot before the page finishes rendering, and attackers can introduce delays without breaking the page's function or alerting victims.

Editorial extensions

If this is right

  • Current snapshot-based visual detectors require updates to account for rendering timing to stay effective against phishing.
  • Attackers can evade detection with minimal changes that preserve the final visual appearance seen by users.
  • Browser extensions can warn about suspicious rendering behavior without contacting remote servers.
  • Visual-only defenses leave a gap that timing attacks can exploit in practice.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Other security tools that rely on static visual snapshots, such as certain malware image classifiers, could face similar timing-based evasions.
  • Detection systems might need to monitor page load progress continuously rather than at a single moment.
  • Combining delayed rendering with other low-visibility changes could further strengthen phishing campaigns.
  • This points toward a broader need for behavioral analysis during the entire rendering process instead of isolated checks.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 2 minor

Summary. The paper claims that visual phishing detectors relying on ML-based similarity to legitimate pages are vulnerable to timing attacks: by delaying rendering of key elements (e.g., logos) via cheap problem-space techniques such as curtain effects, attackers ensure the detector's snapshot is taken before the phishing indicators appear, dropping detection rates from 100% to 0%. The authors argue this vulnerability was overlooked in prior work, empirically demonstrate the attack on SOTA detectors, report a user study in which participants cannot reliably spot the perturbations (p<.05), and propose mitigations including a local browser extension.

Significance. If the timing assumption holds for real detectors, the result identifies a practical, low-cost evasion vector that questions the robustness of an entire class of deployed visual defenses. The empirical defeat rates and human-subject results would be directly actionable for both attackers and defenders; the proposed extension offers a concrete, no-remote-call mitigation path. The work is novel in focusing on rendering timing rather than pixel-level perturbations.

major comments (3)
  1. [Empirical evaluation / attack demonstration] The central claim that detectors are 'completely defeated' (detection rate to 0%) rests on the unverified premise that the evaluated SOTA systems capture a single static snapshot before full rendering completes. The manuscript provides no implementation details, timing policies, or load-event handling descriptions for the tested detectors, leaving the attack's success dependent on an assumption that may not hold if any detector waits for the load event or uses multi-frame capture.
  2. [User study] The user-study result (p<.05) that end users cannot reliably identify the perturbations is reported without sample size, power analysis, task design, or controls for learning effects. Because the human-undetectability claim is used to argue the attack is practical in the wild, these missing details are load-bearing for the overall contribution.
  3. [Experimental setup] No information is supplied on the phishing page corpus, exact implementation of the curtain/delay techniques, or how the visual similarity modules of the SOTA detectors were invoked (e.g., rendering engine, timeout values). Reproducibility and generality of the 100%-to-0% result cannot be assessed without these specifics.
minor comments (2)
  1. [Abstract] The abstract states the attack is 'easy-to-apply' yet later sections could more explicitly separate the technical effort required from the conceptual simplicity.
  2. [Figures and tables] Figure captions and table headers would benefit from explicit mention of the exact detector versions and snapshot conditions used.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for their thorough and constructive review. We address each major comment point by point below, providing clarifications based on our experimental work and indicating where revisions will be made to improve transparency and reproducibility.

read point-by-point responses

  1. Referee: [Empirical evaluation / attack demonstration] The central claim that detectors are 'completely defeated' (detection rate to 0%) rests on the unverified premise that the evaluated SOTA systems capture a single static snapshot before full rendering completes. The manuscript provides no implementation details, timing policies, or load-event handling descriptions for the tested detectors, leaving the attack's success dependent on an assumption that may not hold if any detector waits for the load event or uses multi-frame capture.

    Authors: Our experiments used the official, publicly available implementations of the referenced SOTA visual detectors. Through direct inspection of their code and runtime behavior, we confirmed that they rely on a single snapshot triggered at the page load event without waiting for complete rendering of dynamic elements. We agree, however, that this premise should be explicitly documented rather than assumed. In the revised manuscript we will add a dedicated subsection describing the snapshot timing, load-event handling, and rendering policies of each evaluated detector, including references to their source code and our verification steps. This will make the conditions for the attack's success verifiable and address the concern about multi-frame or delayed-capture variants. revision: yes

  2. Referee: [User study] The user-study result (p<.05) that end users cannot reliably identify the perturbations is reported without sample size, power analysis, task design, or controls for learning effects. Because the human-undetectability claim is used to argue the attack is practical in the wild, these missing details are load-bearing for the overall contribution.

    Authors: The current manuscript reports only the statistical outcome of the user study. We agree that full methodological transparency is required to support the practicality claim. We will expand the user-study section to include the sample size, a power analysis, a detailed description of the task design (including presentation format and participant instructions), and explicit controls for learning effects such as randomization of page order. These additions will allow readers to assess the robustness of the p < .05 result. revision: yes

  3. Referee: [Experimental setup] No information is supplied on the phishing page corpus, exact implementation of the curtain/delay techniques, or how the visual similarity modules of the SOTA detectors were invoked (e.g., rendering engine, timeout values). Reproducibility and generality of the 100%-to-0% result cannot be assessed without these specifics.

    Authors: We acknowledge that the manuscript lacks sufficient detail on the experimental setup to support reproducibility. We will add a new 'Experimental Setup' subsection that specifies the phishing page corpus (size, selection criteria, and construction method), the precise implementation of the curtain and delay techniques (technologies used and timing parameters), and the invocation parameters for each detector (rendering engine, timeout values, and API usage). This will enable independent replication of the reported detection-rate drop. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

Empirical attack demonstration contains no self-referential derivation or fitted inputs

full rationale

The paper reports an empirical attack (delayed rendering via curtain effects) that reduces detection rates from 100% to 0% on tested visual phishing detectors. No equations, parameters, or mathematical derivations appear in the abstract or description. The central claim rests on external experimental results against SOTA systems rather than any internal reduction to the paper's own inputs. No self-citations are load-bearing; the work introduces a novel timing attack without renaming prior results or smuggling ansatzes. The derivation chain is therefore self-contained as a straightforward attack demonstration.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

The central claim rests on the domain assumption that detectors perform a one-time visual snapshot and that rendering delays can be introduced via standard web technologies without side effects. No free parameters or invented entities are described in the abstract.

assumptions (1)
  • domain assumption Visual phishing detectors compute similarity on a static rendered snapshot taken at a fixed time during page load.
    Stated in the abstract as the basis for why delaying elements misleads the detector.

how reviews work

0 comments
Cite this review

Pith. "Pith review of I can't recognize (yet): Delayed Rendering to Defeat Visual Phishing Detectors." pith.science (2026). https://pith.science/paper/2605.00183

@misc{pith2026260500183,
  author       = {Pith},
  title        = {Pith review of: I can't recognize (yet): Delayed Rendering to Defeat Visual Phishing Detectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2605.00183}},
  note         = {Machine review of arXiv:2605.00183}
}
read the original abstract

Phishing webpages are continuously polluting the Web. Plenty of countermeasures have been proposed and the most advanced techniques leverage machine-learning methods that infer whether a webpage is benign or not by inspecting its visual representation. Yet, despite the demonstrated effectiveness of such detection methods, this class of defenses is, by design, susceptible to a kind of subtle-but-cheap timing-based attacks which -- worryingly, and perhaps surprisingly -- have never been investigated so far. Such an oversight questions the overall reliability of these defenses in the wild. First, we show that timing-based evasion attacks have not been accounted for by prior work on visual phishing websites detectors. Then, we elucidate the intrinsic vulnerability of these detectors: they can be bypassed by delaying the rendering of webpage elements. Practically, these detectors must compute the visual similarity between a target webpage and a known legitimate one. This requires taking a "snapshot" of the target webpage before the similarity computation. Attackers can deliberately delay the rendering of key elements, such as the logo, so that these elements appear fully only after the snapshot has been taken. This simple tactic misleads the visual-similarity module, leading the system to incorrectly classify the phishing page as benign. We empirically show that state-of-the-art detectors can be completely defeated (detection rate dropping from 100% to 0%) by employing easy-to-apply problem-space techniques such as curtain effects. We also carry out a user study, evaluating the effectiveness of these attacks against real humans, and find that end users are unable to reliably identify our "perturbations" (p<.05). Finally, we propose mitigations, including a browser-extension that, without making any call to remote services, warns users that they may have landed on a phishing webpage.

Figures

Figures reproduced from arXiv: 2605.00183 by the authors.

Figure 1
Figure 1. Examples of timing-based attacks. We show the original real-world phishing webpage (in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Visual Phishing Detector—We show the workflow of logo￾based and full page-based visual phishing detectors. victim to them). For instance, PhishIntention’s reference list spans 277 brands and ≈4k logos [13]. As shown in [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Adversarial Logo Images. During webpage rendering delays, we apply curtain-effect and pixelation attacks to the logo images. (a) Curtain Effect: logos gradually appear from top to bottom at 0% (invisible), 25%, 50%, 75%, and 100% visibility. (b) Pixelation: logos transition from blurred to clear as the pixel block size decreases from 5 × 5px to 4 × 4px, 3 × 3px, 2 × 2px, and finally the original resolution. images f… view at source ↗
Figures from the paper (9 more)
Figure 5
Figure 5. Figure 5: Curtain effect Effectiveness (on Website). We report the attack success rate of four visual phishing detectors against adversarial screenshots, that are captured during the rendering process of logo, background, and both images, with visibility ranging from 0% to 75%. …
Figure 6
Figure 6. Figure 6: Pixelation Effectiveness (on Website). We report the attack success rates of four visual phishing detectors against adversarial sam￾ples generated by Pixelation attacks. These adversarial screenshots are captured during the rendering of logo images, background images, …
Figure 7
Figure 7. Figure 7: User Perception of Rendering Delays. For RQ3a, each video pair shows a webpage rendering at normal speed vs. delayed speed (2 to 5s delay). We report the percentage of participants responses in ‘similar’, ‘identical’, ‘somewhat similar’ and ‘not similar’ for each delay…
Figure 8
Figure 8. Figure 8: User Perception of Different Rendering Attacks. For RQ3a, each video pair shows a webpage rendering at normal speed vs. delayed speed (2–5s delay). We report the % of responses in ‘similar’, ‘identical’, ‘somewhat similar’ and ‘not similar’ for for each delay and attac…
Figure 9
Figure 9. Figure 9: User Interface of our browser extension. Our prototype can be configured to tailor for the users’ needs. Finally, phishing education can also help: by raising awareness that attackers can exploit such an apparently natural occurrence for malicious purposes, users may b…
Figure 10
Figure 10. Figure 10: Warning overlay. If our browser extension detects something suspicious, it will warn the user. coordinates. The reason why the logo detector is separate from the extension is due to computational efficiency. Intuitively, the extension captures screenshots perpet￾ually…
Figure 12
Figure 12. Figure 12: Curtain effect effectiveness (extended). We report the increase in FNR of four visual phishing detectors when Curtain effect is applied to 18 phishing webpages, compared to the no-atk baseline. The phishing website screenshots are captured during the rendering process…
Figure 11
Figure 11. Figure 11: Assessment on VisualPhishNet. (a) Original Phishing webpage screenshot (Outlook) and (b) its target identified by VisualPhishNet. Their visual distance of 2.1 exceeds the threshold, resulting in misclas￾sification as Benign. (c) Webpage after applying Curtain Effect a…
Figure 13
Figure 13. Figure 13: Pixelation effectiveness (extended). We report the increase in FNR of four visual phishing detectors when Pixelation is applied to 18 phishing webpages, compared to the no-atk baseline. These ad￾versarial screenshots are captured during the rendering of logo images, b…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

91 extracted references · 91 canonical work pages

  1. [1]

    Interet crime report,

    “Interet crime report,” https://www.ic3.gov/AnnualReport/Reports /2024 IC3Report.pdf, FBI, Tech. Rep., 2024

    work page 2024

  2. [2]

    State of the phish 2024,

    “State of the phish 2024,” ProofPoint, Tech. Rep., 2024, https: //www.proofpoint.com/it/resources/threat-reports/state-of-phish

    work page 2024

  3. [3]

    Phishing activity trends report,

    “Phishing activity trends report,” APWG, Tech. Rep., 2024, https: //docs.apwg.org/reports/apwg trends report q2 2024.pdf. 14

    work page 2024

  4. [4]

    Top email threats and trends,

    “Top email threats and trends,” Barracuda, Tech. Rep., 2024, https: //assets.barracuda.com/assets/docs/dms/top-email-threats-and-tre nds-vol1.pdf

    work page 2024

  5. [5]

    Why phishing works,

    R. Dhamija, J. D. Tygar, and M. Hearst, “Why phishing works,” inProc. of ACM CHI, 2006

    work page 2006

  6. [6]

    Why phishing still works: User strategies for combating phishing attacks,

    M. Alsharnouby, F. Alaca, and S. Chiasson, “Why phishing still works: User strategies for combating phishing attacks,”IJHC, 2015

    work page 2015

  7. [7]

    Sixteen years of phishing user studies: What have we learned?

    S. Baki and R. M. Verma, “Sixteen years of phishing user studies: What have we learned?”IEEE TDSC, 2022

    work page 2022

  8. [8]

    An effective detection approach for phishing websites using url and html features,

    A. Aljofey, Q. Jiang, A. Rasool, H. Chen, W. Liu, Q. Qu, and Y . Wang, “An effective detection approach for phishing websites using url and html features,”Scientific Reports, p. 8842, 2022

    work page 2022

Show all 91 references
  1. [9]

    The phishing funnel model: a design artifact to predict user susceptibility to phishing websites,

    A. Abbasi, D. Dobolyi, A. Vance, and F. M. Zahedi, “The phishing funnel model: a design artifact to predict user susceptibility to phishing websites,”Information Systems Research, pp. 410–436, 2021

    2021

  2. [10]

    Pirates of char- ity: Exploring donation-based abuses in social media platforms,

    B. Acharya, D. Lazzaro, A. E. Cin `a, and T. Holz, “Pirates of char- ity: Exploring donation-based abuses in social media platforms,” inProc. of ACM WWW, 2025

    2025

  3. [11]

    An analysis of phishing blacklists: Google safe browsing, openphish, and phishtank,

    S. Bell and P. Komisarczuk, “An analysis of phishing blacklists: Google safe browsing, openphish, and phishtank,” inProc. of ACSW, 2020

    2020

  4. [12]

    {PhishTime}: Continuous longitudinal measurement of the effectiveness of anti-phishing blacklists,

    A. Oest, Y . Safaei, P. Zhang, B. Wardman, K. Tyers, Y . Shoshi- taishvili, and A. Doup ´e, “{PhishTime}: Continuous longitudinal measurement of the effectiveness of anti-phishing blacklists,” in Proc. of USENIX Security, 2020

    2020

  5. [13]

    Inferring phishing intention via webpage appearance and dynamics: A deep vision based approach,

    R. Liu, Y . Lin, X. Yang, S. H. Ng, D. M. Divakaran, and J. S. Dong, “Inferring phishing intention via webpage appearance and dynamics: A deep vision based approach,” inProc. of USENIX Security, 2022

    2022

  6. [14]

    Spacephish: The evasion- space of adversarial attacks against phishing website detectors using machine learning,

    G. Apruzzese, M. Conti, and Y . Yuan, “Spacephish: The evasion- space of adversarial attacks against phishing website detectors using machine learning,” inProc. of ACSAC, 2022

    2022

  7. [15]

    Needle in a haystack: Tracking down elite phishing domains in the wild,

    K. Tian, S. T. Jan, H. Hu, D. Yao, and G. Wang, “Needle in a haystack: Tracking down elite phishing domains in the wild,” in Proc. of IMC, 2018

    2018

  8. [16]

    Catchphish: detection of phishing websites by inspecting urls,

    R. S. Rao, T. Vaishnavi, and A. R. Pais, “Catchphish: detection of phishing websites by inspecting urls,”AIHC, pp. 813–825, 2020

    2020

  9. [17]

    “Real Attackers Don’t Compute Gradients

    G. Apruzzese, H. S. Anderson, S. Dambra, D. Freeman, F. Pierazzi, and K. Roundy, ““Real Attackers Don’t Compute Gradients”: Bridging the Gap Between Adversarial ML Research and Practice,” inProc. of SaTML, 2023

    2023

  10. [18]

    “do users fall for real adversarial phishing?

    A. Draganovic, S. Dambra, J. A. Iuit, K. Roundy, and G. Apruzzese, ““do users fall for real adversarial phishing?” in- vestigating the human response to evasive webpages,” inProc. of APWG eCrime, 2023

    2023

  11. [19]

    Visualphishnet: Zero- day phishing website detection by visual similarity,

    S. Abdelnabi, K. Krombholz, and M. Fritz, “Visualphishnet: Zero- day phishing website detection by visual similarity,” inProc. of ACM CCS, 2020

    2020

  12. [20]

    Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages,

    Y . Lin, R. Liu, D. M. Divakaranet al., “Phishpedia: A hybrid deep learning based approach to visually identify phishing webpages,” inProc. USENIX Security, 2021

    2021

  13. [21]

    It doesn’t look like anything to me: using diffusion model to subvert visual phishing detectors,

    Q. Hao, N. Diwan, Y . Yuan, G. Apruzzese, M. Conti, and G. Wang, “It doesn’t look like anything to me: using diffusion model to subvert visual phishing detectors,” inProc. of USENIX Security, 2024

    2024

  14. [22]

    Evaluating the effectiveness and robustness of visual similarity- based phishing detection models,

    F. Ji, K. Lee, H. Koo, W. You, E. Choo, H. Kim, and D. Kim, “Evaluating the effectiveness and robustness of visual similarity- based phishing detection models,” inProc. of USENIX Security, 2025

    2025

  15. [23]

    Adversarial machine learning at scale,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” inProc. of ICLR, 2017

    2017

  16. [24]

    Attacking logo-based phishing website detectors with adversarial perturbations,

    J. Lee, Z. Xin, M. P. S. Ng, K. Sabharwal, G. Apruzzese, and D. M. Divakaran, “Attacking logo-based phishing website detectors with adversarial perturbations,” inProc. of ESORICS, 2023

    2023

  17. [25]

    Accessibility, usability, and security evaluation of hungarian government websites,

    B. Csontos and I. Heckl, “Accessibility, usability, and security evaluation of hungarian government websites,”Universal Access in the Information Society, pp. 139–156, 2021

    2021

  18. [26]

    Less defined knowledge and more true alarms: Reference-based phishing detection without a pre-defined reference list,

    R. Liu, Y . Lin, X. Teoh, G. Liu, Z. Huang, and J. S. Dong, “Less defined knowledge and more true alarms: Reference-based phishing detection without a pre-defined reference list,” inProc. of USENIX Security, 2024

    2024

  19. [27]

    Apwg ecrime exchange,

    “Apwg ecrime exchange,” https://apwg.org/ecx, 2025

    2025

  20. [28]

    Our repo,

    “Our repo,” https://github.com/joanyy/eurosp26 delayphish

  21. [29]

    What is phishing?

    M. Kosinski, “What is phishing?” https://www.ibm.com/think/topi cs/phishing#732739699, IBM Think, Tech. Rep., 2025, accessed: October, 2025

    2025

  22. [30]

    Phishing and ransomware can be your worst nightmares, how can you prevent these evolving threats?

    Deloitte, “Phishing and ransomware can be your worst nightmares, how can you prevent these evolving threats?” https://www.deloitte .com/lu/en/services/risk-advisory/research/phishing-ransomware-h ow-to-prevent-threats.html, Deloitte, Tech. Rep., 2025, accessed: October, 2025

    2025

  23. [31]

    From attachments to seo: Click here to learn more about clickbait pdfs!

    G. Stivala, S. Abdelnabi, A. Mengascini, M. Graziano, M. Fritz, and G. Pellegrino, “From attachments to seo: Click here to learn more about clickbait pdfs!” inProc. of ACSAC, 2023

    2023

  24. [32]

    D-fence: A flexible, efficient, and comprehensive phishing email detection system,

    J. Lee, F. Tang, P. Ye, F. Abbasi, P. Hay, and D. M. Divakaran, “D-fence: A flexible, efficient, and comprehensive phishing email detection system,” inProc. of EuroS&P, 2021

    2021

  25. [33]

    Raider: Reinforcement- aided spear phishing detector,

    K. Evans, A. Abuadbba, T. Wu, K. Moore, M. Ahmed, G. Pogrebna, S. Nepal, and M. Johnstone, “Raider: Reinforcement- aided spear phishing detector,” inProc. of NSS, 2022

    2022

  26. [34]

    Evaluation of federated learning in phishing email detection,

    C. Thapa, J. W. Tang, A. Abuadbba, Y . Gao, S. Camtepe, S. Nepal, M. Almashor, and Y . Zheng, “Evaluation of federated learning in phishing email detection,”Sensors, p. 4346, 2023

    2023

  27. [35]

    Smishviz: Towards a graph-based visualization system for monitoring and characterizing ongoing smishing threats,

    S. M. Sanjari, A. M. Shibli, M. Mia, M. Gupta, and M. M. A. Pritom, “Smishviz: Towards a graph-based visualization system for monitoring and characterizing ongoing smishing threats,” inProc. of ACM CODASPY, 2024

    2024

  28. [36]

    Sounds vishy: Automating vishing attacks with ai-powered systems,

    J. Figueiredo, A. Carvalho, D. Castro, D. Gonc ¸alves, and N. San- tos, “Sounds vishy: Automating vishing attacks with ai-powered systems,” inProc. of ACM AsiaCCS, 2025

    2025

  29. [37]

    (blind) users really do heed aural telephone scam warnings,

    F. Sharevski, J. Vander Loop, B. Evans, and A. Ponticello, “(blind) users really do heed aural telephone scam warnings,” inProc. of IEEE S&P, 2025

    2025

  30. [38]

    The impact of emerging phishing threats: Assessing quishing and llm-generated phishing emails against organizations,

    M. Weinz, N. Zannone, L. Allodi, and G. Apruzzese, “The impact of emerging phishing threats: Assessing quishing and llm-generated phishing emails against organizations,” inProc. of ACM AsiaCCS, 2025

    2025

  31. [39]

    Cost of a data breach report,

    IBM, “Cost of a data breach report,” https://www.ibm.com/report s/data-breach, IBM, Tech. Rep., 2025, accessed: October, 2025

    2025

  32. [40]

    Phishing trends: November 2023–january 2024,

    Cybercrime Information Center, “Phishing trends: November 2023–january 2024,” https://www.cybercrimeinfocenter.org/phi shing-trends-november-january-2024, 2024, accessed: November, 2025

    2023

  33. [41]

    Google Safe Browsing,

    “Google Safe Browsing,” https://safebrowsing.google.com/, 2025

    2025

  34. [42]

    Urltran: Improving phishing url detection using transformers,

    P. Maneriker, J. W. Stokes, E. G. Lazo, D. Carutasu, F. Tajaddodi- anfar, and A. Gururajan, “Urltran: Improving phishing url detection using transformers,” inProc. of IEEE MILCOM, 2021

    2021

  35. [43]

    Phishing vs. legit: Comparative analysis of client-side resources of phishing and target brand websites,

    K. Lim, J. Park, and D. Kim, “Phishing vs. legit: Comparative analysis of client-side resources of phishing and target brand websites,” inProc. of ACM WWW, 2024

    2024

  36. [44]

    Detection of phishing webpages based on visual similarity,

    L. Wenyin, G. Huang, L. Xiaoyue, Z. Min, and X. Deng, “Detection of phishing webpages based on visual similarity,” inProc.of WWW, 2005

    2005

  37. [45]

    Phishing detection leveraging machine learning and deep learning: A review,

    D. M. Divakaran and A. Oest, “Phishing detection leveraging machine learning and deep learning: A review,”IEEE Security & Privacy, 2022

    2022

  38. [46]

    Evaluating robustness of reference-based phishing detectors,

    E. Roh, S. Jeon, S. Son, and S. Hong, “Evaluating robustness of reference-based phishing detectors,” inProc. of ACM AsiaCCS, 2025

    2025

  39. [47]

    Guidelines for snowballing in systematic literature studies and a replication in software engineering,

    C. Wohlin, “Guidelines for snowballing in systematic literature studies and a replication in software engineering,” inProc. of EASE, 2014

    2014

  40. [48]

    Sok: On the offensive potential of ai,

    S. L. Schr ¨oer, G. Apruzzese, S. Human, P. Laskov, H. S. Anderson, E. W. Bernroider, A. Fass, B. Nassi, V . Rimmer, F. Roliet al., “Sok: On the offensive potential of ai,” inProc. of IEEE SaTM, 2025

    2025

  41. [49]

    Novel keyword co-occurrence network-based methods to foster system- atic reviews of scientific literature,

    S. Radhakrishnan, S. Erbis, J. A. Isaacs, and S. Kamarthi, “Novel keyword co-occurrence network-based methods to foster system- atic reviews of scientific literature,”PloS one, p. e0172778, 2017

    2017

  42. [50]

    Visual-similarity-based phishing detection,

    E. Medvet, E. Kirda, and C. Kruegel, “Visual-similarity-based phishing detection,” inProc. of SecureComm, 2008

    2008

  43. [51]

    Cracking classifiers for evasion: a case study on the google’s phishing pages filter,

    B. Lianget al., “Cracking classifiers for evasion: a case study on the google’s phishing pages filter,” inProc. of WWW, 2016

    2016

  44. [52]

    Deltaphish: Detecting phishing webpages in compromised websites,

    I. Corona, B. Biggio, M. Contini, L. Piras, R. Corda, M. Mereu, G. Mureddu, D. Ariu, and F. Roli, “Deltaphish: Detecting phishing webpages in compromised websites,” inProc. of ESORICS, 2017

    2017

  45. [53]

    A good fishman knows all the angles: A critical evaluation of google’s phishing page classifier,

    C. Miao, J. Feng, W. You, W. Shi, J. Huang, and B. Liang, “A good fishman knows all the angles: A critical evaluation of google’s phishing page classifier,” inProc. of ACM CCS, 2023

    2023

  46. [54]

    Knowledge expansion and counterfactual interaction for{Reference-Based} phishing detection,

    R. Liu, Y . Lin, Y . Zhang, P. H. Lee, and J. S. Dong, “Knowledge expansion and counterfactual interaction for{Reference-Based} phishing detection,” inProc. of USENIX Security, 2023

    2023

  47. [55]

    Combin- ing text and visual features to improve the identification of cloned webpages for early phishing detection,

    B. Van Dooremaal, P. Burda, L. Allodi, and N. Zannone, “Combin- ing text and visual features to improve the identification of cloned webpages for early phishing detection,” inProc. of ARES, 2021. 15

    2021

  48. [56]

    Phishing detection: analysis of visual similarity based approaches,

    A. K. Jain and B. B. Gupta, “Phishing detection: analysis of visual similarity based approaches,”Security and Communication Networks, p. 5421046, 2017

    2017

  49. [57]

    A deep learning technique for web phishing de- tection combined url features and visual similarity,

    S. Al-Ahmadi, “A deep learning technique for web phishing de- tection combined url features and visual similarity,”IJCNC, 2020

    2020

  50. [58]

    Two level filtering mechanism to detect phishing sites using lightweight visual similarity approach,

    R. S. Rao and A. R. Pais, “Two level filtering mechanism to detect phishing sites using lightweight visual similarity approach,” Journal of AIHC, pp. 3853–3872, 2020

    2020

  51. [59]

    Phish-sight: a new approach for phish- ing detection using dominant colors on web pages and machine learning,

    P. Pandey and N. Mishra, “Phish-sight: a new approach for phish- ing detection using dominant colors on web pages and machine learning,”International Journal of Information Security, pp. 881– 891, 2023

    2023

  52. [60]

    Logosense: A companion hog based logo detection scheme for phishing web page and e-mail brand recognition,

    A. S. Bozkir and M. Aydos, “Logosense: A companion hog based logo detection scheme for phishing web page and e-mail brand recognition,”Computers & Security, p. 101855, 2020

    2020

  53. [61]

    Webpage visual feature extraction and similarity algorithm,

    J. Li, C. Zhang, and X. Yu, “Webpage visual feature extraction and similarity algorithm,” inProc. of CIAT, 2020

    2020

  54. [62]

    Phishzoo: Detecting phishing web- sites by looking at them,

    S. Afroz and R. Greenstadt, “Phishzoo: Detecting phishing web- sites by looking at them,” inProc. of IEEE ICSC, 2011

    2011

  55. [63]

    A novel logo identifica- tion technique for logo-based phishing detection in cyber-physical systems,

    P. Panda, A. K. Mishra, and D. Puthal, “A novel logo identifica- tion technique for logo-based phishing detection in cyber-physical systems,”Future Internet, p. 241, 2022

    2022

  56. [64]

    Deep dive into client- side anti-phishing: A longitudinal study bridging academia and industry,

    R. Pourmohamad, S. Wirsz, A. Oest, T. Bao, Y . Shoshitaishvili, R. Wang, A. Doup ´e, and R. A. Bazzi, “Deep dive into client- side anti-phishing: A longitudinal study bridging academia and industry,” inProc. of ACM AsiaCCS, 2024

    2024

  57. [65]

    {KnowPhish}: Large language models meet multimodal knowledge graphs for enhancing{Reference-Based} phishing detection,

    Y . Li, C. Huang, S. Deng, M. L. Lock, T. Cao, N. Oo, H. W. Lim, and B. Hooi, “{KnowPhish}: Large language models meet multimodal knowledge graphs for enhancing{Reference-Based} phishing detection,” inProc. of USENIX Security, 2024

    2024

  58. [66]

    “are adversarial phishing webpages a threat in reality?

    Y . Yuan, Q. Hao, G. Apruzzese, M. Conti, and G. Wang, ““are adversarial phishing webpages a threat in reality?” understanding the users’ perception of adversarial webpages,” inProc. of ACM WWW, 2024

    2024

  59. [67]

    In- triguing properties of adversarial ml attacks in the problem space,

    F. Pierazzi, F. Pendlebury, J. Cortellazzi, and L. Cavallaro, “In- triguing properties of adversarial ml attacks in the problem space,” inProc. of IEEE S&P, 2020

    2020

  60. [68]

    Wild patterns: Ten years after the rise of adversarial machine learning,

    B. Biggio and F. Roli, “Wild patterns: Ten years after the rise of adversarial machine learning,”Pattern Recognition, 2018

    2018

  61. [69]

    Beneath the phishing scripts: A script-level analysis of phishing kits and their impact on real-world phishing websites,

    W. Lee, J. Hur, and D. Kim, “Beneath the phishing scripts: A script-level analysis of phishing kits and their impact on real-world phishing websites,” inProc. of ACM AsiaCCS, 2024

    2024

  62. [70]

    Webdriver,

    “Webdriver,” https://www.selenium.dev/documentation/webdriver/, 2025

    2025

  63. [71]

    pyautogui,

    “pyautogui,” https://github.com/asweigart/pyautogui, 2025

    2025

  64. [72]

    Fastdup,

    “Fastdup,” https://github.com/visual-layer/fastdup, 2025

    2025

  65. [73]

    Pingdom,

    “Pingdom,” https://www.pingdom.com/, 2025

    2025

  66. [74]

    Order bias in a mail survey,

    R. Ferber, “Order bias in a mail survey,”Journal of Marketing, pp. 171–178, 1952

    1952

  67. [75]

    https://www.similarweb.com/top-websites/united-states/, 2025

    2025

  68. [76]

    https://www.semrush.com/website/top/united-states/all/, 2025

    2025

  69. [77]

    CloudFlare, https://blog.cloudflare.com/50-most-impersonated-bra nds-protect-phishing/, 2025

    2025

  70. [78]

    Uncovering the key factors measur- ing web performance,

    N. F. A. Bakar, M. L. Lehat, C. M. N. M. Shafee, S. Rosnan, P. Shamala, and A. A. Jamil, “Uncovering the key factors measur- ing web performance,” inProc. of ICBT, 2024

    2024

  71. [79]

    The menlo report,

    M. Bailey, D. Dittrich, E. Kenneally, and D. Maughan, “The menlo report,”IEEE Security & Privacy, pp. 71–75, 2012

    2012

  72. [80]

    Prolific,

    “Prolific,” https://www.prolific.com/, 2025

    2025

  73. [81]

    Prolific. ac—a subject pool for online experiments,

    S. Palan and C. Schitter, “Prolific. ac—a subject pool for online experiments,”Journal of behavioral and experimental finance, pp. 22–27, 2018

    2018

  74. [82]

    Assessing browser- level defense against{IDN-based}phishing,

    H. Hu, S. T. Jan, Y . Wang, and G. Wang, “Assessing browser- level defense against{IDN-based}phishing,” inProc. of USENIX Security, 2021

    2021

  75. [83]

    Content, nudges and incentives: A study on the effectiveness and perception of embedded phishing training,

    D. Lain, T. Jost, S. Matetic, K. Kostiainen, and S. Capkun, “Content, nudges and incentives: A study on the effectiveness and perception of embedded phishing training,” inProc. of CCS, 2024

    2024

  76. [84]

    Phishing in organizations: Findings from a large-scale and long-term study,

    D. Lain, K. Kostiainen, and S. ˇCapkun, “Phishing in organizations: Findings from a large-scale and long-term study,” inProc. of IEEE S&P, 2022

    2022

  77. [85]

    Put your warning where your link is: Improving and evaluating email phishing warnings,

    J. Petelka, Y . Zou, and F. Schaub, “Put your warning where your link is: Improving and evaluating email phishing warnings,” in Proc. of CHI, 2019

    2019

  78. [86]

    What is in the chrome web store?

    S. Hsu, M. Tran, and A. Fass, “What is in the chrome web store?” inProc. of ACM AsiaCCS, 2024

    2024

  79. [87]

    A login page transparency and visual similarity-based zero-day phishing defense protocol,

    G. Varshney, A. Raj, D. Sangwan, S. Abuadbba, R. Mishra, and Y . Gao, “A login page transparency and visual similarity-based zero-day phishing defense protocol,”Computers & Security, p. 104598, 2025

    2025

  80. [88]

    Crawlphish: Large-scale analysis of client-side cloaking techniques in phish- ing,

    P. Zhang, A. Oest, H. Cho, Z. Sun, R. Johnson, B. Wardman, S. Sarker, A. Kapravelos, T. Bao, R. Wanget al., “Crawlphish: Large-scale analysis of client-side cloaking techniques in phish- ing,” inProc. of IEEE S&P, 2021

    2021

  81. [89]

    Cross-national study on phishing resilience,

    S. Gopavaram, J. Dev, M. Grobler, D. Kim, S. Das, and L. J. Camp, “Cross-national study on phishing resilience,” inUSEC, 2021

    2021

  82. [90]

    Beyond the west: Revealing and bridging the gap between western and chinese phishing website detection,

    Y . Yuan, G. Apruzzese, and M. Conti, “Beyond the west: Revealing and bridging the gap between western and chinese phishing website detection,”Computers & Security, p. 104115, 2025. Open Science Expectations We have already clearly stated that our resources will be openly shar...

    2025

  83. [91]

    These samples are different from the 24 webpages that PhishIn- tention correctly identified as phishing in our main evaluation (§5). TABLE 5.Curtain effecteffectiveness.We report the FNR of four visual phishing detectors–PhishLLM, PhishPedia, PhishIntention and VisualPhishNet–...

Pith tools

Reviewed May 9, 2026 · model on record in the stance chip above.