Exposing the Evaders: PhishLumos Uncovers Hidden Phishing Campaigns

Phishing remains one of the most persistent threats in cybersecurity. Despite growing awareness, humans are vulnerable to urgency and authority, making them susceptible to phishing attacks.

The security community has shifted focus toward automated detection systems, but attackers have adapted by using cloaking techniques, serving benign content to scanners while delivering malicious pages to real victims.

Meet PhishLumos, a system created by Tokyo Metropolitan University researchers that treats redirection and inaccessible pages as suspicious. It analyzes the underlying infrastructure of the URL, including IP addresses, network connections, SSL certificates, and historical scan records.

The system reconstructs the broader phishing campaign, identifying connected URLs and assets. A team of specialized LLM-powered agents then profiles the campaigns, creating validated detection rules.

PhishLumos achieved impressive results in a real-world study, reaching a median campaign coverage of 100% and a median detection lead time of 192.8 hours before expert verification. The system also uncovered 192,407 additional URLs, with 92.0% flagged as malicious by multi-engine scanning services.

Despite its effectiveness, PhishLumos has limitations. It struggles with attackers who avoid reuse, relying on throwaway infrastructure. The system's performance also depends on the quality of external data sources, including web scans, passive DNS, and certificate logs.

PhishLumos is designed to complement existing defenses, not replace them. It's an analyst-facing offline tool, ideal for triaging high-priority seed URLs. The system produces reusable mitigation artifacts supporting workflows such as hunting, blocking, and takedown requests.

Discover how PhishLumos is revolutionizing phishing detection, and how you can benefit from its innovative approach to cybersecurity. Subscribe to our breaking news e-mail alert to stay ahead of the latest threats and vulnerabilities. Subscribe here!