PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT

PhishLang: A Real-Time, Fully Client-Side Phishing Detection Framework Using MobileBERT

Speakers: Sayak Saha Roy

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=iNa1tZfCe7k

Overview

PhishLang is a lightweight, fully client-side phishing detection framework that uses MobileBERT to analyze website source code and detect phishing intent without relying on handcrafted features or server-side infrastructure. The framework parses HTML into structured tag-based representations, capturing only the elements most relevant to phishing behavior, and uses the language model to understand the collective "story" told by these elements.

Deployed in the real world, PhishLang scanned over 42 million domains via CertStream in 4 months, identifying 26,000 phishing websites with 95% validated accuracy. It detected many evasive phishing attacks and consistently outperformed major blocklists: at the time of reporting, most blocklists had not detected more than half of PhishLang's reported samples. As a browser extension, PhishLang uses less than 100 MB of RAM, performs inference in less than 1 second, and on zero-day phishing sites detected 91% of threats -- far ahead of Google Safe Browsing, McAfee, Bitdefender, Avast, and Trend Micro.

Background

▶ Watch: The state of phishing detection: limitations of current approaches (0:00)

Phishing remains a major threat in 2026, with millions of new attacks targeting end users. Current defenses fall into several categories, each with significant limitations:

Feature-based detectors use static features from URLs, domain information, and HTML code patterns. While fast, they rely heavily on handcrafted features that attackers can mask or remove, causing them to miss new evasive attacks.

Dynamic/behavioral detectors analyze website layout, screenshots, and user interaction patterns. While effective at detecting evasive threats, they require heavy multimodal models with high resource demands, making them impractical at scale.

Large language models (ChatGPT, Claude, Gemini) excel at understanding phishing intent but face scalability problems: commercial APIs are prohibitively expensive for scanning millions of domains, and open-source LLMs require GPUs and are slow.

Blocklist-based approaches (Google Safe Browsing, Microsoft SmartScreen, PhishTank, OpenPhish) are the primary deployed defense, with security vendors scanning URLs and adding detections to shared blocklists. However, these systems exhibit significant detection lag -- the critical window during which phishing sites are live and causing damage.

The key insight motivating PhishLang is that language models, even small ones, can capture the relationships between elements in a web page and understand the collective intent -- something rule-based systems and simple ML models cannot do.

Key Findings

▶ Watch: How collective element intent reveals phishing behavior (6:00)

MobileBERT provides the optimal accuracy-efficiency tradeoff. Among nine language models tested, MobileBERT achieved the best balance of detection accuracy (comparable to larger models), memory usage (less than 100 MB), and inference speed (less than 1 second). Llama 2 had the best raw accuracy but required 33+ seconds and ~5 GB of memory.

PhishLang detected 26,000 phishing sites in 42 million CertStream domains. Real-world deployment over 4 months demonstrated practical scalability, with 95% validated detection accuracy based on manual review of random samples.

Major blocklists miss the majority of PhishLang's detections. At the time of reporting to Google Safe Browsing, Microsoft, PhishTank, and OpenPhish, more than half of regular phishing samples were undetected. For evasive scams, detection rates were below 10%.

PhishLang detects evasive phishing without specific training. Despite not being trained on evasive techniques, PhishLang detected behavioral evasion, JavaScript evasion, clickjacking, DOM manipulation, and text encoding evasion attacks, indicating that organic understanding of website behavior transfers to evasive threat detection.

91% zero-day detection, hours ahead of commercial tools. On freshly hosted phishing kit websites, PhishLang detected 91% immediately, while even the best commercial tools (Google Chrome, McAfee) required 3-6 hours to begin catching up.

At least 10x faster than the best-performing behavioral detector. PhishLang is at least 10x faster than PhishIntention (the best visual/behavioral detector tested) while losing only about 1% in efficiency metrics.

Technical Deep Dive

▶ Watch: 42 million domains scanned, 26K phishing sites found in 4 months (10:00)

PhishLang's pipeline has three core stages:

HTML Parsing and Compression: Expert analysis of 500 phishing websites identified that only a limited set of HTML tags consistently reveal malicious intent: title and heading tags, form/input/button tags (credential harvesting), anchor tags and lists (navigation structure), and scripts/iframes (dynamic phishing behavior). Each website is parsed by extracting these tags and converting them into a structured representation: tag name followed by content. This consistently compresses websites to approximately 7 KB regardless of original size, fitting within small language models' token limits.

Intent Modeling: Rather than detecting individual suspicious elements, MobileBERT learns to assess the collective story told by all parsed elements. For example, a form asking for email/password + urgent messaging ("verify immediately") + missing/placeholder navigation links + minimal functionality beyond the credential form -- individually benign features that collectively indicate phishing. The model was fine-tuned on NUS's PhishPedia dataset containing 30K phishing and 30K benign websites.

Client-Side Deployment: The trained model runs entirely in the browser using WebAssembly and TensorFlow.js (implied by the client-side architecture). A whitelist prevents repeated scanning of frequently visited sites. No website data is ever sent to external servers, providing strong privacy guarantees. The extension works on low-configuration systems with median inference time under 1 second and RAM consumption under 100 MB.

The ground truth dataset comes from NUS's PhishPedia dataset, with real-world validation performed on CertStream (a real-time feed of newly registered SSL certificates and their associated domains).

Demo / Proof of Concept

▶ Watch: Client-side browser extension: privacy-preserving deployment (12:00)

PhishLang was deployed as both a scanning pipeline and a browser extension:

CertStream deployment: Over 4 months, PhishLang scanned 42 million domains from the CertStream feed, identifying 26,000 phishing websites. Two human coders validated a random sample, confirming 95% accuracy. Using 18 established criteria, the coders also identified evasive phishing techniques among the detections, finding significant numbers of behavioral evasion, JavaScript evasion, clickjacking, and DOM manipulation attacks.

Browser extension evaluation: On a low-configuration test system, the extension maintained less than 100 MB RAM usage and sub-second inference times across 2,000 new phishing websites.

Commercial tool comparison: The researchers hosted fresh phishing websites using phishing kits (ethically disabled to prevent real credential theft). PhishLang detected 91% on zero day, far ahead of the next-best performers (Google Chrome Safe Browsing and McAfee). Commercial tools required 3-6 additional hours to begin catching up.

Known limitations: PhishLang struggles with CAPTCHA-based phishing, QR code phishing (mitigated by integrating SpicyBar for QR scanning), non-English phishing (mitigated with LangDetect and ArgosTranslate), and fully dynamically rendered websites where HTML content is loaded entirely via JavaScript.

Defensive Implications

▶ Watch: Q&A: evasion strategies and adversarial limitations (16:00)

PhishLang directly addresses the most critical gap in phishing defense: the detection lag between when a phishing site goes live and when blocklists add it. By performing inference locally in real time, PhishLang provides immediate protection without waiting for centralized scanning infrastructure.

For organizations, the implications are:

Complement, don't replace, blocklists. PhishLang excels at zero-day detection, while blocklists provide coverage for known threats. The combination is stronger than either alone. PhishLang's detections can be reported back to blocklists to accelerate their coverage.

Privacy-preserving deployment. Because all inference happens client-side, PhishLang can be deployed in environments where sending browsing data to external servers (Google Safe Browsing, commercial tools) raises privacy or compliance concerns.

Evasion resilience through intent modeling. By understanding collective intent rather than matching specific features, PhishLang maintains effectiveness against evasive techniques that defeat feature-based detectors. However, fully dynamically rendered pages remain a gap.

Open-source availability. PhishLang is available as a browser extension, enabling immediate deployment for security-conscious users and organizations.

The Q&A highlighted an important adversarial consideration: attackers could theoretically evade detection by avoiding the HTML tags PhishLang analyzes, but doing so would degrade the phishing page's effectiveness -- attackers who remove forms, buttons, and input fields to evade detection also remove the elements needed to harvest credentials.

Key Takeaways

• MobileBERT achieves optimal accuracy-efficiency tradeoff for phishing detection: <100 MB RAM, <1 second inference, comparable accuracy to much larger models
• Real-world deployment scanned 42 million domains in 4 months, identifying 26,000 phishing sites with 95% validated accuracy
• PhishLang detected 91% of zero-day phishing sites, hours ahead of Google Safe Browsing, McAfee, Bitdefender, Avast, and Trend Micro
• Major blocklists had not detected more than half of PhishLang's reported samples; for evasive scams, blocklist detection was below 10%
• Intent-based analysis of collective HTML element behavior detects evasive phishing techniques without specific training
• Fully client-side operation provides privacy guarantees -- no browsing data leaves the user's machine
• Available as an open-source browser extension for immediate deployment

About the Speaker(s)

Sayak Saha Roy is an assistant professor at Louisiana State University. His research focuses on phishing detection, web security, and practical applications of language models for security. The project was funded by NSF and Comcast.