Blocklists were already losing ground before AI entered the picture. Phishing domains have been getting shorter-lived for years, campaigns have been burning infrastructure faster, and the gap between blocklists and attacker campaigns keeps getting wider. AI just finished the job.
Attackers are using AI to generate phishing pages from screenshots in minutes, spin up and tear down infrastructure faster than any blocklist can track, and iterate on tooling at a cadence that makes indicator-based detection functionally useless.
89% of phishing domains are now active for fewer than two days, with just 6.5% surviving past 15 days. By the time a domain makes it onto a blocklist, the campaign has moved on and the infrastructure has been replaced.
If your primary defense against attacks delivered via malicious webpages like AiTM phishing, device code phishing, ClickFix, file downloads, malvertising and more relies on matching known-bad indicators, you’re always two steps behind.
Disposable by design
The problem isn’t just that phishing infrastructure rotates quickly. Modern attacks are designed to be disposable from the outset. Attackers aren’t waiting to get caught and then pivoting. They’re proactively tearing down pages and spinning up new ones to stay ahead of detection, treating each piece of infrastructure as single-use by default.
Attackers are also making that infrastructure harder to analyze while it’s live, combining trusted hosting platforms — Cloudflare Workers, Railway, Vercel, Microsoft Dynamics, SharePoint, Adobe, Google Firebase, Google Sites, Jotform, Linode, Azure, Cloudflare, Atlassian, and many more are commonly abused — with bot protection, screening checks, and complex redirect chains on top to filter out researchers and automated scanners.
95% of in-browser attacks that Push Security detects use some form of bot protection, often layered with referrer checks and browser fingerprinting. The page a crawler sees and the page a real victim sees are frequently not the same page. And by the time you get to a once-malicious page (whether spun up by attackers or by compromising an existing site) the malicious payload may no longer be active.
AI has also collapsed the cost of creating the pages themselves, too. Attackers were already proficient at cloning pages, but they can now vibe-code entire phishing sites from a screenshot of a legitimate login page — a convincing frontend with a completely unique codebase that looks nothing like the real page it’s based on, and nothing for static analysis to fingerprint.
And phishing delivery increasingly abuses legitimate services — AI chatbot sharing features, search ad placement, in-app messages and app-generated emails — to inherit the domain reputation of platforms no blocklist would ever flag.
The result is an environment where adding indicators to a blocklist is a bit like playing whac-a-mole, in a game that’s rigged against you from the start.
AI adoption has exploded, but every new app, integration and extension introduces new threats and risks.
The latest webinar from Push Security uncovers the scale of Shadow AI in the enterprise, how attackers are taking advantage, and what security teams can do about it.
The tools layer is crumbling too
For years, the middle of David Bianco’s Pyramid of Pain offered a more durable detection surface. Instead of blocking individual domains, you could fingerprint phishing kits — their JavaScript structure, HTML patterns, code signatures — and write detections that survived across dozens or hundreds of campaigns even as infrastructure rotated.
That layer is eroding. The phishing kit ecosystem now fragments through forking, AI-assisted development, and open-source-style code sharing faster than anyone can track.
Device code phishing is the clearest example. From early adoption in Russia-linked campaigns in 2024, it’s taken until 2026 to really take off — at which point adoption has exploded from zero criminal kits in the wild to 25+ distinct kits (and counting).
Criminal PhaaS kits like EvilTokens (340+ organizations in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others all offer the capability. Established AiTM vendors like Tycoon 2FA have added device code phishing alongside their existing credential-harvesting capabilities, and we’ve recently observed kits dynamically switching between payloads depending on the environment and target’s behavior. For example, attempting device code phishing first, then falling back to AiTM if it times out.
These kits are often controlled by attacker-operated admin panels that give full control over the payload and when it’s delivered, used in conjunction with voice-based social engineering and only “activating” the malicious page when performed by an admin.
This further reduces the chance that these pages can be flagged and blocked ahead of time — they may only be seen a couple of times in targeted attacks before being rotated out.
In Push Security’s recent webinar (now available on-demand), VP R&D Luke Jennings showcased just how easy it is to vibe-code your own PhaaS kit.
What actually survives: techniques
Genuinely new attack techniques still require human creativity to discover — an attacker has to identify a gap in how a legitimate protocol or feature can be subverted and operationalize it. That kind of innovation hasn’t been automated, and detections built around how those techniques work can survive infrastructure rotation, tool proliferation, and kit fragmentation.
Take adversary-in-the-middle (AiTM) phishing. Every AiTM kit — Tycoon, Sneaky 2FA, Evilginx, or countless forks and derivatives (we’re tracking 75+ kits in the wild) implements fundamentally the same interception technique: proxy the victim’s session through attacker-controlled infrastructure, relay credentials and MFA tokens in real time, and capture the authenticated session.
The frontends vary and the infrastructure rotates, but the behavioral mechanics of the interception are the constant.
ClickFix tells a similar story. Whether the lure is a fake CAPTCHA (up 563% per CrowdStrike), a fake browser update, or a fake error dialog, the underlying technique is the same: inject malicious commands into the user’s clipboard and instruct them to paste and execute the payload. The social engineering wrapper changes; the behavioral signature doesn’t.
Device code phishing is the same again. You’re interacting with a legitimate device code login page and ultimately completing a device code auth grant. It doesn’t matter what kit the attacker uses or where they host the page polling for the code, the destination page and user behavior is the same.
Detecting at the technique level targets the thing that’s hardest for attackers to change — the mechanics of the attack itself. But it demands two things that most detection programs lack.
First, you need visibility where these attacks actually execute. AiTM interception, ClickFix clipboard manipulation, OAuth consent abuse, device code phishing — these techniques play out inside browser sessions where network proxies see encrypted traffic and EDR sees nothing at all. If your detection stack can’t observe the page at the moment the user interacts with it, technique-level detection isn’t available to you.
Second, you need research velocity. The window between technique discovery and industrialization into criminal toolkits is compressing — device code phishing took roughly a year to go from nation-state novelty to commodity PhaaS feature, and ClickFix followed a similar trajectory.
Defenders who can extract a behavioral signature and deploy a detection before commoditization have a structural advantage that compounds over time. Waiting for indicators — even tool-level indicators — means chasing a curve that’s accelerating away from you.
The proof: a detection with zero IOC overlap
Earlier this year, Microsoft published research documenting a novel technique that weaponized OAuth error-handling redirects as a phishing delivery mechanism — exploiting standards-compliant redirect behavior to route users from trusted identity provider domains to attacker-controlled pages. From a URL-filtering perspective, the initial link carried the domain reputation of login.microsoftonline.com.
Push’s agentic threat hunting pipeline — AI agents operating as a force multiplier for human researchers, continuously hunting across browser telemetry from 3+ million deployments — ingested that research and extracted the behavioral mechanics, not the published IOCs. The agents built a detection targeting the behavioral signature: the OAuth redirect.
Months after creating the detection, later, it fired on a completely different campaign. A user at a Push customer had been targeted — but with different lures, different domains, different infrastructure, and a previously unseen phish kit behind the redirect, compared to the original (a malware download payload).
The underlying technique was identical. None of the original IOCs appeared anywhere in the attack chain.
A blocklist-based approach would have missed this entirely (the domains weren’t flagged as malicious at the time), and a tool-signature approach would have missed it too — the phish kit didn’t match any known samples. The only detection that survived was the behavioral technique itself.
The OAuth redirect case isn’t an isolated example. The same pipeline led to the discovery and detection of three novel browser-based attack techniques — InstallFix (malware delivery disguised as software installation prompts), ConsentFix (OAuth consent phishing combined with ClickFix-style user manipulation), and LLMShare (malware delivery via AI chatbot sharing features).
In several cases, detections were blocking active campaigns before the technique had been publicly documented.
So far, Push’s agentic pipeline has protected 60+ customers in the last three months alone who were targeted with novel phishing techniques — intercepting ~225 threat instances before the attacker could compromise an account, or trick the user into interacting with a malware payload.
What this means for security teams
The industry spent decades building bigger blocklists. AI made that approach structurally obsolete — not just slow, but architecturally incapable of keeping pace.
What remains durable is the top of the Pyramid: technique-level behavioral detection, built around how attacks work rather than the infrastructure or tooling that implements them. Defending at that level requires browser-session visibility and a research pipeline fast enough to stay ahead of the compressing timeline from technique discovery to criminal adoption.
At Push Security, we’ve built that pipeline using AI agents as a force multiplier for human researchers, continuously hunting across browser telemetry and shipping technique-level detections that survive indicator rotation — tripling monthly detection output not by building bigger blocklists, but by operationalizing behavioral detection at the top of the Pyramid at machine speed.
Book a demo to learn more.
Sponsored and written by Push Security.
