AI Is Helping Attackers Create Disposable Phishing Infrastructure That Blocklists Can't Track
Blocklists were already losing ground before generative AI entered the picture. Phishing domains have been getting shorter-lived for years, campaigns burn infrastructure faster, and the gap between detection lists and attacker campaigns keeps widening. AI just finished the job.
Attackers now generate phishing pages from screenshots in minutes, spin up and tear down infrastructure faster than any blocklist can track, and iterate on tooling at a cadence that makes indicator-based detection functionally useless. The result is an environment where adding indicators to a blocklist is like playing whack-a-mole in a game rigged against you from the start.
The Disposable Infrastructure Model
89% of phishing domains are now active for fewer than two days. Only 6.5% survive past 15 days. By the time a domain makes it onto a blocklist, the campaign has moved on and the infrastructure has been replaced.
The problem isn't just that phishing infrastructure rotates quickly. Modern attacks are designed to be disposable from the outset. Attackers aren't waiting to get caught and then pivoting. They're proactively tearing down pages and spinning up new ones to stay ahead of detection, treating each piece of infrastructure as single-use by default.
Attackers combine trusted hosting platforms with bot protection, screening checks, and complex redirect chains to filter out researchers and automated scanners. Cloudflare Workers, Railway, Vercel, Microsoft Dynamics, SharePoint, Adobe, Google Firebase, Google Sites, Jotform, Linode, Azure, Atlassian — the list of abused legitimate hosting platforms grows by the week.
95% of in-browser attacks use some form of bot protection, often layered with referrer checks and browser fingerprinting. The page a crawler sees and the page a real victim sees are frequently not the same page. By the time you reach a once-malicious page, the malicious payload may no longer be active.
AI-Generated Phishing Pages from Screenshots
AI has collapsed the cost of creating phishing pages entirely. Attackers were already proficient at cloning pages, but they can now vibe-code entire phishing sites from a screenshot of a legitimate login page. The result: a convincing frontend with a completely unique codebase that looks nothing like the real page it's based on, and nothing for static analysis to fingerprint.
Phishing delivery increasingly abuses legitimate services — AI chatbot sharing features, search ad placement, in-app messages, app-generated emails — to inherit the domain reputation of platforms no blocklist would ever flag.
The Fragmenting Toolkit Ecosystem
For years, the middle of the Pyramid of Pain offered a more durable detection surface. Instead of blocking individual domains, defenders could fingerprint phishing kits — their JavaScript structure, HTML patterns, code signatures — and write detections that survived across dozens or hundreds of campaigns even as infrastructure rotated.
That layer is eroding. The phishing kit ecosystem now fragments through forking, AI-assisted development, and open-source-style code sharing faster than anyone can track.
Device code phishing is the clearest example. From early adoption in Russia-linked campaigns in 2024, it took until 2026 to really take off, at which point adoption exploded from zero criminal kits in the wild to 25+ distinct kits, and counting.
Criminal PhaaS kits include EvilTokens (340+ organizations compromised in its first five weeks), Kali365 (which earned an FBI advisory), ARToken, DEBULL, Forg365, and many others. Established AiTM vendors like Tycoon 2FA have added device code phishing alongside their existing credential-harvesting capabilities. Push has observed kits dynamically switching between payloads depending on the environment and target's behavior, attempting device code phishing first, then falling back to AiTM if it times out.
These kits are often controlled by attacker-operated admin panels that give full control over the payload and when it's delivered. They only "activate" the malicious page when performed by an admin, further reducing the chance that pages get flagged and blocked ahead of time. They may only be seen a couple of times in targeted attacks before being rotated out.
Push Security tracks 75+ AiTM (adversary-in-the-middle) kits in the wild, including Tycoon, Sneaky 2FA, Evilginx, and countless derivatives. ClickFix saw a 563% increase per CrowdStrike data. The window between technique discovery and industrialization into criminal toolkits is compressing, device code phishing took roughly one year to go from nation-state novelty to commodity PhaaS feature.
What Actually Survives: Technique-Level Detection
Genuinely new attack techniques still require human creativity to discover, an attacker has to identify a gap in how a legitimate protocol or feature can be subverted and operationalize it. That kind of innovation hasn't been automated, and detections built around how those techniques work can survive infrastructure rotation, tool proliferation, and kit fragmentation.
Take adversary-in-the-middle (AiTM) phishing. Every AiTM kit implements fundamentally the same interception technique: proxy the victim's session through attacker-controlled infrastructure, relay credentials and MFA tokens in real time, and capture the authenticated session. The frontends vary and the infrastructure rotates, but the behavioral mechanics of the interception are the constant.
ClickFix tells a similar story. Whether the lure is a fake CAPTCHA, a fake browser update, or a fake error dialog, the underlying technique is the same: inject malicious commands into the user's clipboard and instruct them to paste and execute the payload. The social engineering wrapper changes; the behavioral signature doesn't.
Device code phishing is the same again. You're interacting with a legitimate device code login page and ultimately completing a device code auth grant. It doesn't matter what kit the attacker uses or where they host the page polling for the code, the destination page and user behavior is the same.
The Proof: A Detection with Zero IOC Overlap
Earlier this year, Microsoft published research documenting a novel technique that weaponized OAuth error-handling redirects as a phishing delivery mechanism, exploiting standards-compliant redirect behavior to route users from trusted identity provider domains to attacker-controlled pages. From a URL-filtering perspective, the initial link carried the domain reputation of login.microsoftonline.com.
Push's agentic threat hunting pipeline — AI agents operating as a force multiplier for human researchers, continuously hunting across browser telemetry from 3+ million deployments — ingested that research and extracted the behavioral mechanics, not the published IOCs. The agents built a detection targeting the behavioral signature: the OAuth redirect.
Months after creating the detection, it fired on a completely different campaign. A user at a Push customer had been targeted, but with different lures, different domains, different infrastructure, and a previously unseen phish kit behind the redirect, compared to the original (a malware download payload). The underlying technique was identical. None of the original IOCs appeared anywhere in the attack chain.
A blocklist-based approach would have missed this entirely. A tool-signature approach would have missed it too, the phish kit didn't match any known samples. The only detection that survived was the behavioral technique itself.
The same pipeline led to the discovery and detection of three additional novel browser-based attack techniques: InstallFix (malware delivery disguised as software installation prompts), ConsentFix (OAuth consent phishing combined with ClickFix-style user manipulation), and LLMShare (malware delivery via AI chatbot sharing features). In several cases, detections were blocking active campaigns before the technique had been publicly documented.
So far, Push's agentic pipeline has protected 60+ customers in the last three months alone who were targeted with novel phishing techniques, intercepting approximately 225 threat instances before the attacker could compromise an account or trick the user into interacting with a malware payload.
What This Means for Security Teams
The industry spent decades building bigger blocklists. AI made that approach structurally obsolete, not just slow, but architecturally incapable of keeping pace.
What remains durable is the top of the Pyramid: technique-level behavioral detection, built around how attacks work rather than the infrastructure or tooling that implements them. Defending at that level requires two things most detection programs currently lack.
First, visibility where these attacks actually execute. AiTM interception, ClickFix clipboard manipulation, OAuth consent abuse, device code phishing, these techniques play out inside browser sessions where network proxies see encrypted traffic and EDR sees nothing at all. If your detection stack can't observe the page at the moment the user interacts with it, technique-level detection isn't available to you.
Second, research velocity. The window between technique discovery and industrialization into criminal toolkits is compressing. Defenders who can extract a behavioral signature and deploy a detection before commoditization have a structural advantage that compounds over time. Waiting for indicators, even tool-level indicators, means chasing a curve that's accelerating away from you.
The only durable defense is technique-level behavioral detection built around how attacks work rather than infrastructure or tooling. It demands browser-session visibility and a research pipeline fast enough to stay ahead of the compressing timeline from technique discovery to criminal adoption.
