Do Attackers Use Algorithms to Evade ML? An In-the-Wild Phishing Case Study
summary
Five years of red‑team competitions and an 11‑tactic in‑the‑wild phishing study show manual tricks dominate: 2021 winners achieve perfect evasion with invisible text and payload‑droppers, averaging 5–8 queries per sample and embedding payloads in Bible verses or base64; 2022 introduces a genetic algorithm that manipulates idempotent DOM actions but uses an order‑of‑magnitude more queries. A hundred real phish reveal logo tampering, cropping, OCR attacks, cloaking and email pipeline abuses; under 40% algorithms appear among top solutions.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:20tabby cat
- 6:22Machine Learning Security Evasion Competition
- 15:00Image-Based Web Phishing Detection: Approach
- 21:29Evasion Tactics: Masking
- 30:55Email Analysis Pipeline for Phish Detection
- 33:59Summary & Call To Action
related talks
30mEvasive Maneuvers: Trends in Phishing Evasion & Anti-Evasion
52mFlying Under the Radar - New Security Evasion Techniques
16mTowards Adversarial Phishing Detection
51mDeepPhish: Simulating Malicious AI
45mWinning by deception: tactics, techniques, and procedures of adversarial A.I.
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
26mMachine Learning Security Evasion Competition 2020
38mPhishing LLMs: Reeling in the Machine