Inside the Phishing Reel: Leveraging Browser Instrumentation to Analyse Evasive Phishing

Phishing websites remain a persistent threat, compromising millions of user credentials each year. While advanced classifiers have improved detection accuracy, they rely on crawlers that are easily redirected by cloaking techniques, limiting their effectiveness in real-world deployments. In this work, we propose a novel data collection approach using a modified Chromium browser capable of collecting information from phishing samples despite client-server cloaking tactics. Using this approach, we collected 432,237 unique phishing samples over eight months and introduced a clustering algorithm that groups samples based on shared deployment characteristics, achieving a Normalized Mutual Information (NMI) score of 0.846.