The High-Stakes Cat-and-Mouse Game of Phishing

The High-Stakes Cat-and-Mouse Game of Phishing

Speakers: Jacob Torrey, Head of Labs, Thinkst Applied Research

Conference: Kawaiicon

YouTube: https://www.youtube.com/watch?v=d6i4Z8RO7b8

Overview

In "The High-Stakes Cat-and-Mouse Game of Phishing," Jacob Torrey, Head of Labs at Thinkst Applied Research, dissects the relentless and rapidly evolving struggle between phishing attackers and security defenders. Far from being a static, easily preventable threat, Torrey illustrates phishing as a dynamic battleground where advancements from one side are quickly met with counter-innovations from the other. The talk challenges the perception of phishing as a concern only for the "gullible," revealing it as the number one initial entry vector for modern breaches, impacting even the most security-conscious organizations.

Torrey's presentation is a critical exploration of the modern phishing landscape, highlighting sophisticated techniques that bypass traditional security measures and even multi-factor authentication (MFA). He introduces Thinkst Canary's innovative CSS-based detection mechanism, designed to provide pre-authentication visibility into adversary-in-the-middle attacks, and then immediately demonstrates how rapidly attackers have adapted to circumvent such defenses. Ultimately, the talk drives home a singular, urgent message: the only true "silver bullet" against the escalating phishing threat is the widespread adoption of device-bound passkeys.

The relevance of this discussion is underscored by the current cybersecurity climate, where identity and authentication represent a critical "seam" in the shared responsibility model between cloud providers and their customers. Attackers actively exploit this gap in visibility and control, pushing the boundaries of what is considered a successful phishing attack. Torrey's insights provide a sobering, yet actionable, perspective on how organizations can navigate this complex and ever-changing threat landscape, emphasizing the need for robust, cryptographic protections over reliance on user awareness or traditional detection methods alone.

Background

▶ Watch: Introduction and the "silver bullet" for phishing (0:00)

The history of phishing, as presented by Torrey, reveals a remarkable evolution from rudimentary scams to highly sophisticated attacks. In the 1990s and early 2000s, phishing primarily revolved around malicious attachments (e.g., the Love Bug virus) and rudimentary credential theft for services like e-gold or PayPal. Attackers leveraged poor endpoint protection and the difficulty of hosting convincing fake websites. Establishing infrastructure was challenging; domains were not free, SSL certificates were expensive and required identity verification, and dial-up internet made hosting high-fidelity replicas impractical. Consequently, early phishing sites were often static mirrors, easily identifiable by their lack of functionality beyond the login page and their reliance on HTTP. Torrey notes that as late as 2010, 99% of phishing sites still used HTTP, a testament to these infrastructure barriers.

The landscape shifted dramatically around 2010. The advent of free domains, readily available SSL certificates (e.g., Let's Encrypt), and cloud hosting services democratized the deployment of sophisticated phishing infrastructure. Attackers now benefit from "DevOps for attackers," utilizing phishing kits that allow them to spin up management platforms, orchestrate email campaigns, generate unique lures, and steal sessions with minimal effort, often via a simple Docker command. This ease of deployment coincided with the consolidation of identities through Single Sign-On (SSO) protocols like SAML and OAuth. As endpoint protection improved, attackers pivoted from malware distribution to credential phishing, targeting major identity providers such as Google Workspace, Microsoft Entra ID (M365), and Okta. Today, over 80% of all phishing attacks aim for credential theft, making it the number one initial entry vector for modern breaches.

Torrey attributes this success to a critical vulnerability within the shared responsibility model adopted by cloud vendors. While vendors manage the underlying infrastructure, customers are responsible for their data and, crucially, for identity and authentication. This overlap creates a "seam" where visibility and clear communication break down. Microsoft, for instance, possesses raw telemetry of login attempts, but lacks specific context for a customer's expected user behavior beyond coarse-grain Conditional Access policies. Conversely, customers only see high-level sign-in logs, often delayed, and lack the detailed, real-time telemetry needed for effective detection. This inherent visibility gap at the identity boundary is precisely where modern phishing attackers thrive, exploiting the ambiguity and lack of granular insight to bypass defenses.

Key Findings

▶ Watch: Modern phishing techniques: Browser-in-the-Browser, Adversary-in-the-Middle (8:10)

The talk's central finding is the relentless and accelerating pace of the "cat-and-mouse game" in phishing. What was once considered a relatively static threat has become a dynamic battleground, with attackers and defenders introducing new techniques and countermeasures almost monthly. Torrey emphasizes that Multi-Factor Authentication (MFA), while an improvement, is not a silver bullet. The majority of popular MFA methods, including many push-based authenticators (like the Microsoft Authenticator app), are still phishable through sophisticated techniques that steal session tokens. The only truly phishing-resistant MFA solution highlighted is the adoption of device-bound passkeys.

Thinkst Canary's contribution to this fight is a novel CSS-based detection token, designed to provide pre-authentication alerts for adversary-in-the-middle (AITM) phishing attacks targeting services like Entra ID. This open-source solution leverages corporate branding CSS to embed an invisible Canary token, triggering an alert if the login page is proxied by an attacker, often before a user even enters their password. This innovation demonstrated significant success, catching dozens of unique phishing domains weekly, with nearly half using TLS certificates issued on the day of detection, indicating rapid attacker infrastructure deployment and burning.

However, the rapid counter-response from attackers underscored the dynamic nature of the threat. Phishing kit developers, particularly for tools like Evil Jinx Pro, quickly implemented countermeasures such as the Referrer-Policy header to prevent browsers from sending referrer information, effectively blinding the CSS token. They also introduced specific evasions to rewrite or remove references to known Canary token domains. This immediate adaptation necessitated further defensive tweaks, such as CSS Unicode encoding to bypass simple string matching.

A particularly concerning finding was the emergence of highly sophisticated attacks like "phishing from Entra ID," demonstrated by Keanu Nys. This technique allows attackers to phish users while they remain on the legitimate login.microsoftonline.com domain, using valid certificates, by redirecting them to an attacker-controlled tenant with a visually indistinguishable typo-squatted domain. Such attacks render traditional user awareness training and many detection methods largely ineffective, further cementing the argument for cryptographic, device-bound authentication. The timeline presented by Torrey vividly illustrates this rapid back-and-forth, showing major attacker and defender moves occurring within months, or even weeks, of each other over the past year and a half.

Technical Deep Dive

▶ Watch: Real-world success of the Canary token detection (15:30)

Torrey delves into three prominent modern phishing techniques, culminating in the Adversary-in-the-Middle (AITM) approach that Thinkst Canary's detection aims to counter.

1. Browser-in-the-Browser (BITB): This technique relies on advanced JavaScript and CSS to create a convincing, fake browser window within the legitimate browser. Attackers can mimic the operating system's theme (e.g., Mac vs. Windows, dark mode) and even display a fake lock icon that, if clicked, would show a "valid Microsoft certificate." The illusion is so complete that users are often unaware they are interacting with a purely front-end construct, not a real browser window.
2. Browser-in-the-Middle (BITM): Taking BITB a step further, BITM involves the attacker spinning up a headless Chrome or other browser instance in kiosk mode on their own infrastructure. Victims connect to this attacker-controlled VM via web-based RDP-like protocols (e.g., NoVNC, Guacamole). The user's interaction is effectively remote-controlling this browser, which then genuinely browses to the target site (e.g., Entra ID). From Microsoft's perspective, it appears as a legitimate Chrome login. Crucially, the attacker can install keyloggers and session dumpers within their controlled browser environment, capturing credentials and session tokens.
3. Adversary-in-the-Middle (AITM): This is the most prevalent and scalable technique discussed, functioning as a reverse proxy. An adversary deploys a server that intercepts traffic between the victim and the legitimate target site. Using fishlets (rewrite rules), the proxy dynamically modifies content, replacing strings or regular expressions to maintain the illusion while capturing sensitive data. AITM is highly effective because many enterprise environments use corporate proxies, and target sites are designed to accommodate proxied connections. The attacker's proxy itself uses a valid TLS certificate for their phishing domain, and then connects to the legitimate target site, also with a valid TLS certificate, making it difficult for users to discern malicious activity based on TLS alone.

Torrey highlights that many common MFA types are vulnerable to these AITM attacks. While MFA adds a layer of security, methods like push notifications from the Microsoft Authenticator app can still be phished. Once an attacker obtains a session token, it can often be replayed, bypassing subsequent MFA challenges. Furthermore, detection based on rapid session movement (e.g., IP address changes) is often ineffective due to legitimate user behaviors like VPN usage or mobile tethering. The only exception presented is device-bound passkeys, which cryptographically tie authentication to a specific device, rendering session tokens useless if stolen and replayed from a different device.

Thinkst Canary's defensive innovation against AITM phishing, particularly for Entra ID, leverages CSS-based Canary tokens. The core mechanism exploits the browser's behavior when fetching resources and the Referer header.

• Normal Flow: A user navigates to login.microsoftonline.com. The page includes corporate branding CSS, which might reference an invisible 1x1 image hosted on a CDN like Amazon CloudFront. When the browser fetches this image, it sends a Referer header indicating login.microsoftonline.com. A CloudFront function (a lightweight serverless function) validates this legitimate referrer and serves the image.
• Attack Flow (AITM): A user is lured to an attacker's proxy domain (e.g., bad.com). The proxy retrieves the legitimate Entra ID page, applies its rewrite rules, and serves it to the victim. The corporate branding CSS is also proxied. When the victim's browser attempts to fetch the invisible image from CloudFront, it sends a Referer header containing bad.com (the attacker's domain). The CloudFront function detects this illegitimate referrer and, instead of serving the image, issues a 302 redirect to Thinkst's Canary token server. This redirect triggers an alert to the tenant owner before the user has even entered their password, providing crucial early warning.

Attackers quickly developed countermeasures. Evil Jinx Pro, a paid phishing kit, introduced two primary evasions:

1. Referrer-Policy Header: The phishing site adds a Referrer-Policy: no-referrer header, instructing the browser not to send any referrer information when requesting resources. This blinds the Canary token, as the CloudFront function receives no referrer to evaluate. Torrey notes a temporary "small win" when an old Chrome bug caused Chrome to ignore this header, but it was subsequently fixed.
2. Fishlet Evasions: For non-Pro versions of Evil Jinx, specific rewrite rules were added to fishlets. These rules would detect and rewrite any requests containing cloudfront.net (Thinkst's CDN) to nothing, preventing the Canary token from being loaded or triggered.

Thinkst responded with its own counter-countermeasures:

1. CSS Unicode Encoding: To bypass simple string matching in fishlets, Thinkst started encoding parts of the cloudfront.net string within the CSS using Unicode escape sequences (e.g., \u0063\u006c\u006f\u0075\u0064\u0066\u0072\u006f\u006e\u0074\u002e\u006e\u0065\u0074). This exploits a parser differential between the browser (which decodes it correctly) and the phishing kit's simpler string-matching logic.
2. Kiosk Mode Detection: For BITM attacks, which often rely on kiosk mode to hide the browser's true origin, Thinkst introduced custom CSS that triggers a different URL (and thus an alert) specifically when the browser is detected to be in full-screen (kiosk) mode. This is acknowledged as a "small win" due to the rarity of users logging into IDPs in full-screen.

Finally, Torrey details a highly sophisticated attack, "phishing from Entra ID," demonstrated at Defcon. This targeted technique leverages typo-squatted domains (e.g., micro-hyen-of.com) and custom CSS fonts to visually mask the typo on the legitimate login.microsoftonline.com page. The attacker sets up their own Entra ID tenant for the typo-squatted domain, configured to pass through to an attacker-controlled on-premises Active Directory server where malware is installed to dump credentials. The user is redirected to the attacker's tenant login page on login.microsoftonline.com, making the certificate valid and the URL appear legitimate. MFA bypass can even be achieved by dynamically generating all possible MFA token values within an attacker-controlled tenant. This attack is virtually undetectable by the user and bypasses Thinkst's CSS token because the user is technically logging into a valid Microsoft tenant, albeit one controlled by the attacker.

Demo / Proof of Concept

▶ Watch: Attackers' counter-measures: Evil Jinx Pro evasions (18:00)

Torrey describes a demonstration of the Thinkst Canary CSS token in action against an Evil Jinx phishing kit, showcasing its effectiveness in providing pre-authentication alerts. The process begins with the attacker using Evil Jinx to quickly set up and orchestrate a phishing campaign, generating a unique lure URL.

When a victim navigates to this attacker-controlled URL, the Evil Jinx proxy intercepts the request and serves a page visually identical to a legitimate Microsoft login portal. As the user enters their username for a targeted tenant, the Canary token embedded within the corporate branding CSS is activated. This triggers a request to the Amazon CloudFront CDN. Crucially, because the request originates from the attacker's proxy domain (not login.microsoftonline.com), the CloudFront function detects the illegitimate Referer header and issues a 302 redirect to the Canary token server. At this precise moment, an alert is triggered for the tenant owner, all before the user has even typed in their password. The visual demonstration highlights a cat picture appearing as the background (a fun way to show the CSS loading) and then the subsequent requests to the CDN and Canary token server.

The success of this detection mechanism is significant. Torrey reports that the service is processing "north of 200 requests per second," protecting "over a thousand logins" in a matter of minutes. It consistently catches "dozens of unique domains" every week, with approximately half of these domains having their TLS certificates issued on the very day they were detected. This indicates a pattern of attackers rapidly deploying and then burning through infrastructure, knowing their sites will be quickly identified. The solution is offered as free, easy to deploy, and open source, costing only "a few hundred bucks a month" to protect millions of logins via CloudFront, making it a highly accessible and impactful defensive tool.

Defensive Implications

▶ Watch: Conclusion: importance of Devicebound Passkeys and rapid evolution (24:30)

The talk provides several critical defensive implications for organizations facing the evolving threat of phishing:

1. Prioritize Device-Bound Passkeys: This is the unequivocal "silver bullet" against phishing. Organizations must aggressively move towards phishing-resistant MFA, with device-bound passkeys being the gold standard. No amount of user awareness training or traditional detection (including Thinkst's token) can offer the cryptographic assurance that passkeys provide, especially against advanced attacks that appear to originate from legitimate domains.
2. Enhance Visibility at the Identity Seam: Recognize and address the visibility gaps inherent in the shared responsibility model. While outsourcing identity management to cloud providers offers benefits, it often means sacrificing granular access logs and real-time telemetry. Solutions like Thinkst Canary's CSS token, even with their limitations, offer a crucial aperture into pre-authentication activity at this critical seam, providing early warnings that Azure sign-in logs might miss or delay.
3. Implement CSS-Based Canary Tokens: For organizations using Azure or similar identity providers, deploying the open-source CSS Canary token is a valuable, low-cost defensive measure. It provides early detection for many common Adversary-in-the-Middle (AITM) attacks, specifically catching lower-effort phishing kits that haven't fully implemented advanced evasions. The ability to detect an attack before a password is entered is a significant advantage.
4. Stay Abreast of Attacker Evolution: The pace of innovation in phishing is extremely rapid. Defenders must continuously monitor new techniques, such as the Referrer-Policy header, CSS Unicode encoding, and "phishing from Entra ID," to understand current threats and adapt defenses. Reliance on static security controls or outdated user training will inevitably lead to compromise.
5. Understand Limitations of User Awareness Training: While user education remains important, it cannot be the sole defense. Highly sophisticated attacks, particularly those that keep users on seemingly legitimate login pages with valid certificates, render even tech-savvy users vulnerable. The focus should shift to technical controls that prevent successful credential theft, rather than solely relying on users to identify increasingly subtle lures.
6. Monitor for Rapid Infrastructure Deployment: The observation that many phishing domains have TLS certificates issued on the day of detection highlights attackers' rapid deployment and burning of infrastructure. Security teams should develop mechanisms to monitor for newly registered domains and SSL certificates that mimic their organization or common identity providers, as these could indicate imminent phishing campaigns.
7. Evaluate the True Cost of Outsourcing Security Boundaries: Organizations should quantify the "loss of visibility" when entrusting critical security functions, like identity, to external vendors. While cost-effective, this outsourcing can significantly complicate detection engineering and incident response if raw telemetry and real-time access logs are unavailable.

Key Takeaways

• Phishing is a highly dynamic and rapidly evolving "cat-and-mouse game" between attackers and defenders, with new techniques and countermeasures emerging almost monthly.
• Most Multi-Factor Authentication (MFA) types, including popular push notifications, are phishable through sophisticated Adversary-in-the-Middle (AITM) attacks; device-bound passkeys are the only truly phishing-resistant solution.
• Thinkst Canary's open-source CSS-based token provides crucial pre-authentication visibility and early warning for AITM phishing against services like Entra ID by detecting illegitimate referrers.
• Attackers rapidly adapt, deploying countermeasures like the Referrer-Policy header and specific rewrite rules in phishing kits to blind detection mechanisms, necessitating continuous defensive innovation.
• Sophisticated attacks, such as "phishing from Entra ID," can deceive users on legitimate login pages with valid certificates, highlighting the severe limitations of user awareness training and traditional detection methods.
• The shared responsibility model in cloud environments creates significant visibility gaps at the identity and authentication "seam," making effective detection engineering challenging for customer organizations.

About the Speaker(s)

Jacob Torrey is the Head of Labs at Thinkst Applied Research, a company renowned for its innovative deception technology, particularly Canary tokens and honeypots. His work focuses on understanding and countering advanced threats, often by developing novel detection mechanisms. Torrey's background includes a personal anecdote about inadvertently spreading the Love Bug virus in his youth, underscoring his long-standing engagement with the dynamics of cyber threats. Beyond his research, he curates "Thinkscapes," a quarterly newsletter that synthesizes thousands of talks, papers, and blog posts in information security research into key themes and impactful discoveries. His expertise lies in translating complex attack techniques and defensive strategies into practical insights for the cybersecurity community.