Offensive Countermeasures Against Phishing Through Fake Data Injection

Phishing attacks have led to significant financial losses, estimated between $3.50 million and $4.00 million annually from 2015 to 2020, prompting urgent action from stakeholders to mitigate these threats. This research addresses the pervasive issue of phishing by proposing an innovative offensive countermeasure model. The primary objective is to render phishing websites ineffective by injecting them with substantial amounts of fake data, thus confusing attackers and prolonging their efforts to access real user information. This study employs a role-playing experiment involving 30 cybersecurity specialists, divided into three groups interacting with different types of databases: real data, real data with injected fake data, and solely fake data. The methodology leverages Python's Beautiful-Soup and Faker libraries to generate and inject fake data into phishing websites, with corresponding fake data saved in a legitimate website’s database for IP blocking. Results indicate that the proposed model significantly hinders attackers, as they are made to deal with databases containing fake data, taking them substantially more time to access user accounts compared to those with only real data. These findings imply that the offensive countermeasure model can effectively delay phishing attacks, providing stakeholders with critical time to update blacklists and reduce zero-day attack risks, ultimately enhancing cybersecurity defense further.