Full Report
AI is helping attackers create disposable phishing infrastructure and rapidly evolving toolkits that blocklists cannot track fast enough. Push Security explains why browser-level, technique-based detection offers a more durable defense than relying on domains, signatures, and other known-bad indicators. [...]
Analysis Summary
# Tool/Technique: AI-Driven Disposable Phishing Infrastructure
## Overview
This technique involves the use of Generative AI to automate the creation of unique, short-lived phishing websites and infrastructure. By leveraging "vibe-coding" (generating code from screenshots) and reputable cloud hosting, attackers bypass traditional blocklists and static signature-based detections.
## Technical Details
- **Type**: Technique / Attack Framework
- **Platform**: Web Browsers, Cloud SaaS Platforms (M365, Google Workspace)
- **Capabilities**: Rapid infrastructure rotation, AI-generated unique codebases, AiTM (Adversary-in-the-Middle), and Device Code Phishing.
- **First Seen**: Techniques evolved significantly in 2024; widespread "Agentic" AI adoption noted in 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566 - Phishing]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1528 - Steal Application Access Token]
- **[TA0005 - Defense Evasion]**
- [T1564.010 - Virtualization/Sandbox Evasion: Ad-versary-in-the-Middle]
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
## Functionality
### Core Capabilities
- **Infrastructure Rotation**: 89% of phishing domains are active for less than 48 hours, rendering domain-based blocklists obsolete.
- **Reputation Hijacking**: Abuses legitimate services (Cloudflare Workers, Vercel, Microsoft Dynamics, Google Firebase) to inherit high domain reputation.
- **Vibe-Coding**: Using AI to create unique frontend code from a screenshot of a legitimate site, preventing HTML/CSS fingerprinting.
### Advanced Features
- **Anti-Analysis/Bot Protection**: 95% of attacks use browser fingerprinting and referrer checks to serve different content to researchers/crawlers than to victims.
- **Dynamic Payloads**: Phishing kits that switch between credential harvesting, AiTM, and Device Code flows based on the victim's environment.
- **Device Code Phishing**: Exploiting OAuth 2.0 device authorization flows to bypass MFA without requiring a proxy.
## Indicators of Compromise
- **File Names**: N/A (Web-based)
- **Network Indicators**:
- [h]xxps://[legitimate-cloud-provider]/[unique-id]
- Abused services: `workers[.]cloudflare[.]com`, `vercel[.]app`, `firebaseapp[.]com`, `dynamics[.]com`
- **Behavioral Indicators**:
- Rapid redirects through multiple reputable cloud domains.
- Unexpected requests for Microsoft/Google device codes during login.
- Browser-level anomalies (e.g., unauthorized access to local storage/session tokens).
## Associated Threat Actors
- **Groups**: Russia-linked threat actors (early adopters of device code phishing).
- **Service Providers (PhaaS)**: EvilTokens, Kali365, ARToken, DEBULL, Forg365, Tycoon 2FA.
## Detection Methods
- **Technique-Based Detection**: Focus on browser-level behaviors (e.g., how the page handles tokens) rather than the domain name.
- **Identity Context**: Analyzing discrepancies between the login request origin and the identity provider’s expectations.
- **Behavioral Monitoring**: Detecting "ClickFix" patterns or unauthorized MFA prompt triggers.
## Mitigation Strategies
- **Move Beyond Blocklists**: Shift defense focus from "known-bad" indicators to "known-good" behavioral baselines.
- **FIDO2/WebAuthn**: Implement hardware-based security keys to provide the strongest resistance against AiTM and device code phishing.
- **Conditional Access**: Restrict logins to managed devices or specific geographic locations.
- **Browser Security**: Use browser-level security tools that inspect page intent rather than just URL reputation.
## Related Tools/Techniques
- **AiTM (Adversary-in-the-Middle)**: Proxying traffic to capture sessions.
- **ClickFix**: Social engineering techniques used to trick users into running malicious commands.
- **Shadow AI**: The use of unauthorized AI tools within enterprises that attackers exploit.