TOAMI (Casting Net): A Browser Extension Tool for Supporting Phishing Hunters

TOAMI (Casting Net): A Browser Extension Tool for Supporting Phishing Hunters

Speakers: Yuichi Tsuboi, Cyber Threat Intelligence Operations Architect, NTT Docomo Business

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=jIGFz-Ca8po

Overview

In an era where phishing attacks are escalating in sophistication and frequency, the critical role of phishing hunters in identifying and neutralizing these threats cannot be overstated. Yuichi Tsuboi, a Cyber Threat Intelligence Operations Architect at NTT Docomo Business, presented "TOAMI (Casting Net): A Browser Extension Tool for Supporting Phishing Hunters" at CODE BLUE. This talk introduced a novel browser extension designed to empower both seasoned and novice phishing hunters by automating key aspects of phishing site analysis and detection. The tool aims to standardize and streamline the often-manual and resource-intensive process of identifying malicious sites, ultimately contributing to a more robust defense against cybercrime.

The motivation behind TOAMI stems from the alarming rise in phishing incidents and the inherent challenges faced by individuals and organizations dedicated to combating them. Phishing attacks are becoming increasingly sophisticated, often employing advanced techniques like cloaking and leveraging Phishing-as-a-Service (PhaaS) models, making traditional detection methods less effective. TOAMI addresses these challenges by integrating automated screenshot capture, redirect path visualization, and advanced detection mechanisms like Favicon Hash comparison, Keyword Detection, and Indicator of Kit (IOK) analysis directly within the browser environment. This approach significantly reduces the operational burden on phishing hunters, mitigates the risk of human error, and democratizes access to effective phishing detection capabilities.

TOAMI is a significant contribution to the cybersecurity community, particularly for its focus on operational efficiency and skill transfer. By automating repetitive tasks and incorporating standardized detection logic, the tool allows less experienced individuals to contribute meaningfully to phishing defense efforts, fostering the growth of the phishing hunter community. Its ability to capture crucial forensic data and visualize complex redirect chains directly within the browser positions it as an invaluable asset for threat intelligence operations and incident response, ultimately bolstering collective efforts to dismantle phishing infrastructure and protect users from financial and data loss.

Background

▶ Watch: Introduction and growing phishing threat (0:00)

The landscape of phishing threats has undergone a dramatic transformation, evolving from crude attempts to highly sophisticated and targeted attacks. According to the Phishing Countermeasures Council's Phishing Report 2027 (likely a typo, intended 2023 or 2024 given the context of previous year's data), the number of reported phishing incidents to the council in 2024 (as of the talk's context) surged by approximately 1.44 times compared to the previous year, reaching nearly 1.72 million cases. This relentless increase underscores the urgent need for more effective countermeasures. Attackers now meticulously craft fake websites and emails that are virtually indistinguishable from legitimate ones, employing advanced techniques to evade detection and deceive users.

Several factors contribute to this escalating threat. Phishing sites are often ephemeral, rapidly appearing and disappearing to evade takedown efforts, and are generated in massive volumes. Attackers utilize cloaking techniques (04:00) to present different content to legitimate users versus security researchers, making detection and analysis particularly challenging. The proliferation of AI-driven tools has simplified the generation of convincing phishing emails and social media posts. Furthermore, the emergence of Phishing-as-a-Service (PhaaS) (04:00) platforms has lowered the barrier to entry for cybercriminals, enabling a division of labor within the criminal ecosystem and accelerating the deployment of new phishing campaigns.

In response to this growing threat, a dedicated community of "phishing hunters" actively works to identify, track, and analyze phishing sites and emails. These individuals, often security researchers or passionate volunteers, play a crucial role in preventing user harm by facilitating take-downs, issuing warnings, and sharing intelligence. However, their work is fraught with challenges. Phishing hunting is a resource-intensive activity, often limited by individual capacity and requiring specialized skills. The rapid evolution of attack methods demands constant adaptation and a high degree of technical expertise. Manual processes, such as repeatedly visiting suspicious URLs to gather screenshots or analyze site content, are prone to human error, missed opportunities, and can be time-consuming. Attackers' cloaking mechanisms often prevent re-visiting a site if they detect it's a security researcher, leading to lost evidence. The lack of standardized tools and methodologies further exacerbates these issues, creating a bottleneck in rapid response and intelligence sharing. These operational hurdles highlight a critical need for automated, standardized, and accessible tools to support the vital work of phishing hunters.

Key Findings

▶ Watch: TOAMI's core concept: IOK and automation (8:30)

The core innovation and key finding presented by Tsuboi-san is the development of TOAMI, a browser extension designed to address the significant operational challenges faced by phishing hunters. The primary insight driving TOAMI's creation was the realization that many aspects of phishing site analysis could be automated, thereby overcoming limitations such as human error in data collection, the need for highly specialized skills, and the difficulties posed by anti-analysis techniques like cloaking.

One of the fundamental findings that sparked TOAMI's development was the observation that phishing sites often exhibit characteristic structural patterns (08:00) due to the widespread reuse of phishing kits. Recognizing this, Tsuboi-san identified the Indicator of Kit (IOK) format, developed and open-sourced by PhishReport, as a pivotal tool. IOKs describe unique features of phishing kits, such as folder structures, specific JavaScript or CSS files, custom parameters, or reused code snippets. By leveraging IOKs, TOAMI can detect phishing sites even if they are rapidly redeployed or if their superficial appearance changes, provided they originate from a known kit. This allows for the detection of many phishing sites without requiring deep, specialized knowledge from the hunter, thereby standardizing detection and enabling less experienced individuals to contribute effectively.

Another crucial finding was the necessity of automating screenshot acquisition (08:00). Manual screenshot capture is prone to omission, especially when dealing with a high volume of suspicious URLs or when sites employ cloaking to prevent repeat visits. TOAMI's automatic screenshot feature ensures that visual evidence, complete with a UTC timestamp embed (26:00) for forensic integrity, is reliably collected upon the first successful access. This not only prevents the loss of critical evidence but also eliminates the tedious manual effort, allowing hunters to focus on higher-value analysis. The positive reception of these initial concepts at a "Cyber Tamago" workshop (10:00) the previous year validated the demand and utility of such a tool, leading to its full implementation and presentation at CODE BLUE.

Technical Deep Dive

▶ Watch: Live demo: TOAMI detecting a phishing site (17:00)

TOAMI is architecturally designed as a browser extension, providing a lightweight yet powerful platform for phishing analysis directly within the user's web browser (Chrome, Edge, Mac, Windows, Linux compatible). This design choice addresses the need for a tool that operates seamlessly within existing workflows, avoiding the overhead of separate applications and allowing it to function even in environments with stringent security restrictions. The extension is composed of four primary architectural components: the Service Worker (Background Script), Popup (Action), Content Script, and Options Page.

The Service Worker, acting as the core "heart" (28:00) of TOAMI, operates in the background, continuously monitoring network requests and recording crucial information. It automatically tracks and visualizes redirect chains (14:00), providing a clear path from the initial suspicious URL to the final landing page, which is essential for understanding complex cloaking and redirection techniques used by attackers. This component also orchestrates other functionalities, such as saving data to local storage, triggering screenshot captures, and managing file downloads via the browser's downloads API.

The Popup (Action) component serves as the main user interface for quick interactions. Accessible via the browser's extension icon, it allows users to enable/disable TOAMI, toggle automatic screenshot capture, adjust notification display times, and access more detailed settings. Critically, it provides an interface to edit JSON-formatted brand detection rules (18:00) directly within the browser, enabling customization of detection criteria without requiring advanced technical skills.

The Content Script is injected into specific web pages to perform in-depth analysis of the page's content. After the Document Object Model (DOM) is loaded, this script extracts vital information such as the HTML source, page title, textual content, and metadata. This data is then used for two primary detection mechanisms:

1. Keyword Detection: The script scans the page content for specific keywords defined in the user-editable JSON rules (e.g., "Docomo", "D-Account" for the demo) to identify potential brand impersonations (14:00).
2. IOK (Indicator of Kit) Analysis: Leveraging the js-yaml (30:00) library, the Content Script parses Sigma rules (referred to as IOKs in the context of phishing kits) that describe common characteristics of known phishing kits. These characteristics can include specific folder structures, unique JavaScript or CSS files, or proprietary parameters embedded within the page. If the page's structure or content matches a defined IOK rule, TOAMI flags it as a potential phishing site (14:00). The speaker specifically noted the lack of Japanese-targeted IOKs and aims for TOAMI to foster their creation and use (32:00).

Finally, the Options Page provides a more extensive interface for managing configuration, particularly for longer or more complex data sets like the brands.json file. While the IOK editing functionality is planned for future implementation, this page is intended to house advanced settings and rule management.

Beyond these core components, TOAMI implements several sophisticated detection and data collection features:

• Favicon Hash Matching: The tool calculates the hash of a site's favicon and compares it against known legitimate brand favicons. A mismatch can indicate brand impersonation (12:00, 14:00).
• Automated Screenshot Capture: Once a page fully loads and returns a 200 HTTP status, TOAMI automatically takes a screenshot. Crucially, this screenshot is embedded with a UTC timestamp (26:00), providing undeniable evidence of the site's appearance at the time of access for abuse reporting.
• Hunting Log Output: All collected data—including URL, title, HTTP status, response headers, HTML source, JavaScript execution environment information, favicon hash, detection results (IOK, keyword, favicon), and screenshot location—is aggregated and outputted as a single JSON record (24:00). This standardized log format facilitates post-analysis, sharing, and integration with other threat intelligence platforms. TOAMI also includes logic to prevent false positives by checking detected sites against a whitelist of legitimate domains (26:00).

Demo / Proof of Concept

▶ Watch: Future enhancements and vision for TOAMI (31:30)

The demonstration of TOAMI showcased its practical application in a simulated phishing attack scenario, highlighting its key features and operational efficiency. The demo environment was set up on an Ubuntu virtual machine (16:00), running Google Chrome (and also demonstrated compatibility with Microsoft Edge), with the TOAMI extension installed. To simulate a real-world attack chain, a Dockerized mail server was used to send a fake phishing email, and a Dockerized web server (Nginx) acted as a redirector and host for the phishing site itself (20:00, 22:00).

The demo began by confirming that the TOAMI extension was properly installed and active in both Chrome and Edge browsers. The speaker then navigated to the extension's popup interface, demonstrating how users can easily enable/disable TOAMI, toggle automatic screenshot capture, and adjust notification display times (18:00). A particularly important feature highlighted was the ability to edit the brands.json file directly within the browser (18:00). This JSON file contains the custom rules for favicon hashes and keywords that TOAMI uses for brand impersonation detection, allowing hunters to tailor the tool to specific targets or emerging threats.

The core of the demo involved accessing a simulated phishing site. The speaker opened the fake email, which contained a malicious link disguised as a legitimate NTT Docomo service. Upon clicking this link, the browser first landed on a "redirector" site (22:00), mimicking common attacker tactics to hide the true phishing destination. This redirector then forwarded the browser to the actual phishing site, which was designed to impersonate the Docomo brand using a known phishing kit.

As the browser navigated through the redirect chain and loaded the phishing page, TOAMI sprang into action:

• Real-time Detection: A toast notification (20:00) appeared in the bottom right corner of the screen, indicating that TOAMI was active and had detected a potential threat.
• Multi-faceted Alerts: The detection notifications, displayed in prominent red text (24:00), showed that the site was flagged by multiple TOAMI engines:
• IOK Detection: The notification specified which IOK rule file matched the site's structure.
• Keyword Detection: It indicated that brand-specific keywords like "Docomo" and "D-Account" were found within the site's content.
• Redirect Route Visualization: TOAMI also displayed the detected redirect chain, showing the path from the initial entry point to the final phishing page (24:00).
• Automated Screenshot and Logging: In the background, TOAMI automatically captured a screenshot of the phishing page, embedding a UTC timestamp (26:00) for forensic purposes. Concurrently, all collected data, including the URLs, titles, HTTP status, HTML source, detection results, and screenshot location, were compiled into a single JSON log file (24:00) and saved locally, providing a comprehensive record of the incident.

The demo effectively illustrated how TOAMI automates the crucial, yet often tedious, aspects of phishing site investigation, providing immediate alerts and comprehensive forensic data, thereby significantly enhancing the efficiency and reliability of phishing hunting operations.

Defensive Implications

▶ Watch: Q&A: Expanding TOAMI for general user protection (36:50)

TOAMI presents significant defensive implications for organizations and individual security practitioners engaged in combating phishing. By automating and standardizing key aspects of phishing site analysis, the tool directly addresses several critical challenges, empowering defenders to be more proactive and effective.

Firstly, TOAMI significantly reduces the skill barrier for phishing hunting. The ability to leverage IOK (Indicator of Kit) rules for detection means that even individuals with less specialized knowledge can identify sophisticated phishing sites that rely on known kits. This standardizes detection logic, moving beyond anecdotal recognition of suspicious sites. By making the process more accessible, organizations can expand their pool of phishing hunters, allowing more team members to contribute to threat intelligence gathering and incident response without extensive, specialized training. This is crucial as the volume of phishing attacks continues to overwhelm limited expert resources.

Secondly, the automation features of TOAMI directly enhance operational efficiency and data integrity. The automatic capture of screenshots, complete with UTC timestamps, eliminates the risk of human error or omission in collecting critical visual evidence for abuse reports. This ensures that take-down requests are backed by robust, verifiable proof, improving their success rate. The visualization of redirect routes provides immediate insight into complex attack chains involving cloaking and multiple redirects, which are often used to evade detection. This data is invaluable for understanding attacker methodologies and strengthening network defenses. The standardized JSON log output further streamlines post-incident analysis and facilitates seamless integration with other Security Information and Event Management (SIEM) systems or threat intelligence platforms, enabling faster response times and better-informed decision-making.

Looking ahead, the planned enhancements for TOAMI promise even greater defensive capabilities. The integration of Yara rules (32:00) will allow for more flexible and powerful pattern matching against phishing site content, expanding detection beyond IOKs. Support for multiple proxies (32:00) will enable hunters to evade attacker cloaking mechanisms more effectively, ensuring that the true phishing content is always accessed for analysis. Furthermore, the future incorporation of machine learning (32:00) for automated detection promises to enhance the tool's ability to identify novel and sophisticated phishing sites, improving detection accuracy and reducing false positives.

Ultimately, TOAMI enables a more proactive and collaborative defense against phishing. By standardizing intelligence gathering and making it easier to identify and document phishing attacks, the tool fosters better information sharing within the security community, both domestically and internationally. This collective effort is essential to keep pace with the rapidly evolving threat landscape and to mitigate the widespread impact of phishing attacks on individuals and enterprises alike.

Key Takeaways

• Automated Phishing Site Analysis: TOAMI significantly streamlines phishing hunting by automating critical tasks such as screenshot capture with UTC timestamps and the visualization of redirect chains, reducing manual effort and preventing evidence loss.
• Standardized Detection with IOKs: The tool leverages Indicator of Kit (IOK) rules (Sigma format) to detect phishing sites based on the structural characteristics of known phishing kits, standardizing detection logic and making it accessible to less experienced hunters.
• Multi-faceted Detection Mechanisms: TOAMI combines Favicon Hash comparison, Keyword Detection within site content, and IOK analysis to provide robust, multi-layered detection of brand impersonation and phishing activity.
• Enhanced Operational Efficiency: By providing a browser-based solution with customizable rules (e.g., brands.json) and standardized JSON log output, TOAMI improves the efficiency of threat intelligence gathering and incident response, facilitating quicker analysis and abuse reporting.
• Empowering the Phishing Hunter Community: TOAMI lowers the skill barrier for phishing hunting, enabling more individuals to contribute to anti-phishing efforts and fostering the growth of the community, particularly in regions like Japan where specific IOKs are less prevalent.
• Future-Proofing Defenses: Planned enhancements, including support for Yara rules, multi-proxy support for cloaking evasion, and the integration of machine learning, aim to further increase detection accuracy and cover a broader range of unknown phishing threats.

About the Speaker(s)

Yuichi Tsuboi is a Cyber Threat Intelligence Operations Architect at NTT Docomo Business, where he is affiliated with the Innovation Center. His professional responsibilities encompass a wide range of activities aimed at bolstering cybersecurity defenses. He is involved in the verification of defensive technology products, the eradication and elucidation of threat infrastructure, and the technical collaboration with various internal NTT Docomo organizations and external entities. Notably, Tsuboi-san is also an active phishing hunter, contributing to the discovery, tracking, and analysis of phishing campaigns. He participates in several prominent cybersecurity organizations, including the Phishing Countermeasures Council, the Japan Network Security Association, and the Japan Security Operation Business Association, where he engages in working group activities. His work focuses on both the technical aspects of threat intelligence and the development of practical tools to support the broader security community.