PhishDecloaker: Detecting CAPTCHA-cloaked Phishing Websites via Hybrid Vision-based Interactive Models

PhishDecloaker: Detecting CAPTCHA-cloaked Phishing Websites via Hybrid Vision-based Interactive Models

Speakers: Xiwen Teoh, National University of Singapore; Yun Lin; Ruofan Liu

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=37JCT_BWnG0

Overview

In an escalating arms race between phishers and anti-phishing entities, threat actors continually devise sophisticated cloaking techniques to evade detection and deny access to security crawlers. A particularly insidious and growing trend is CAPTCHA-cloaked phishing, where malicious websites integrate CAPTCHA challenges to hide their true content from automated analysis tools while presenting a seemingly legitimate facade to unsuspecting users. This talk introduces PhishDecloaker, a novel hybrid vision-based system designed to automatically detect, recognize, and solve diverse CAPTCHA types on suspicious web pages, thereby revealing the hidden phishing content for downstream analysis.

PhishDecloaker addresses a critical blind spot in current anti-phishing defenses. Traditional security measures, including leading services like VirusTotal, Google Safe Browsing, and Microsoft SmartScreen, have proven largely ineffective against CAPTCHA-cloaked sites. A compelling 7-day study conducted by the researchers revealed that none of their 500 CAPTCHA-cloaked phishing kits were detected by these established services. This alarming statistic underscores the urgent need for innovative solutions like PhishDecloaker, which acts as a black box that, given a suspicious website with a CAPTCHA, solves the challenge to expose the underlying malicious content. The system's modular, three-stage approach—detection, recognition, and solving—promises a robust and extensible framework for combating this evolving threat, offering a significant advancement in protecting users from sophisticated phishing campaigns.

Background

▶ Watch: Introduction: CAPTCHA-cloaked phishing problem (0:00)

The landscape of cyber security is characterized by an incessant "cat and mouse game" between attackers and defenders, particularly in the realm of phishing. As anti-phishing technologies advance, so do the methods employed by phishers to evade detection. Historically, attackers have leveraged various cloaking techniques to obscure their malicious intent from security scanners. These include implementing IP and user agent blacklists to block known security crawlers, generating one-time URLs for phishing emails to limit exposure, or employing browser fingerprinting to differentiate between a legitimate user and an automated analysis bot.

More recently, a new and highly problematic trend has emerged: CAPTCHA cloaking. This technique involves embedding CAPTCHA challenges on phishing pages, effectively hiding the malicious content behind a seemingly innocuous security gate. This trend has been widely reported by prominent security companies and institutions, including Trend Micro, Palo Alto Networks, and AT&T, highlighting its growing prevalence and impact.

CAPTCHA cloaking presents several significant challenges to conventional anti-phishing defenses:

1. False Sense of Legitimacy: The widespread use of CAPTCHAs on legitimate websites, particularly for common workflows like authentication (statistics show over 25% of the top 1 million popular websites use CAPTCHAs), instills a false sense of security. Unsuspecting visitors are likely to lower their guard when encountering a CAPTCHA on a phishing site, assuming it's a standard security measure rather than a cloaking mechanism.
2. Low Deployment Cost: The barrier to entry for phishers is remarkably low. Numerous free or open-source CAPTCHA services, such as reCAPTCHA and hCaptcha, can be easily integrated into any website. This accessibility allows attackers to deploy sophisticated cloaking with minimal effort and cost.
3. Difficulty in Bypassing Detection: The inherent design of CAPTCHAs, intended to distinguish humans from bots, makes them exceptionally difficult for automated anti-phishing systems to bypass. The researchers' own 7-day study, involving 500 CAPTCHA-cloaked phishing kits, starkly demonstrated this challenge: none of these kits were detected by leading security services like VirusTotal, Google Safe Browsing, or Microsoft SmartScreen. This critical vulnerability highlights the ineffectiveness of current blacklisting and static analysis approaches against this dynamic form of cloaking.

The emergence of CAPTCHA cloaking necessitates a paradigm shift in anti-phishing detection, moving beyond static analysis to interactive, vision-based approaches that can mimic human interaction to solve CAPTCHA challenges and uncover the hidden threats.

Key Findings

▶ Watch: PhishDecloaker's three-stage approach overview (2:00)

The field study conducted to evaluate PhishDecloaker's practicality and effectiveness yielded several critical insights into the landscape of CAPTCHA-cloaked phishing and the system's performance:

• Enhanced Detection of Zero-Day Phishing: PhishDecloaker significantly improved the detection of previously unknown phishing sites. The system helped discover 7.6% more phishing websites that were not reported by any other comparative study group, and it captured the most zero-day phishing websites overall. A "zero-day" phishing website was defined as one not reported by VirusTotal at the time of inspection, underscoring PhishDecloaker's ability to identify novel threats.
• Distinct Targeting Sectors: The study revealed that CAPTCHA-cloaked phishing websites tend to target different sectors compared to ordinary phishing sites. While some overlap exists, CAPTCHA-cloaked campaigns primarily focused on cryptocurrency and social networking brands, indicating a strategic choice by attackers to target high-value or highly trafficked platforms.
• Prevalence of Free CAPTCHA Services: Fishers predominantly utilize free and convenient CAPTCHA services. The field study found that reCAPTCHA and hCaptcha were overwhelmingly the most common CAPTCHA types used by phishing websites. This distribution contrasts with legitimate websites, which exhibit a wider variety of CAPTCHA services.
• Reusable CAPTCHA Service API Keys as IoCs: An intriguing and highly impactful observation was made regarding the reuse of CAPTCHA service API keys. These keys, extractable from the CAPTCHA iframe within the website's DOM, showed a roughly Pareto distribution in their usage on CAPTCHA-cloaked phishing sites. Specifically, fewer than 20% of the API keys accounted for more than 55% of CAPTCHA cloaking instances. For example, one specific hCaptcha API key was found to be reused across 19 different phishing websites. This strong correlation suggests that these reused API keys can serve as potent Indicators of Compromise (IoCs) for future phishing detection efforts.
• Shorter Lifespan, Longer Evasion: Surprisingly, CAPTCHA-cloaked phishing websites had a slightly shorter median lifespan (approximately 9 hours) compared to ordinary phishing sites (about 13 hours). However, and critically, it took blacklist-based detectors (like VirusTotal, Google Safe Browsing, and Microsoft SmartScreen) approximately 40% longer, or an additional 11 hours, to register CAPTCHA-cloaked phishing sites in their blacklists compared to ordinary phishing. This extended period of initial evasion significantly increases the window of opportunity for attackers to compromise victims before detection.
• PhishDecloaker Performance Overhead: The median overhead for PhishDecloaker's operations was measured as: detection (0.4 seconds), recognition (0.3 seconds), and solving (15 seconds). While the solving time is the most significant, the researchers note that it can be effectively mitigated through the use of task priority queues and asynchronous processing, allowing for scalable deployment by dividing components into individual, independently scalable clusters (detector/recognition, solving, and fishing detection clusters).

Technical Deep Dive

▶ Watch: Recognition stage: Deep Sis model and metric learning (4:00)

PhishDecloaker operates on a sophisticated three-stage approach: detection, recognition, and solving. This modular design allows for specialized processing at each step, ensuring robustness and extensibility.

Detection Stage

The initial stage focuses on identifying potential CAPTCHA regions within a given web page screenshot. This problem is modeled as an object detection problem.

• Model Architecture: PhishDecloaker employs a modified Faster R-CNN (Regions with Convolutional Neural Network features), a well-established object localization network.
• Training Objective: Crucially, this detector is trained with only localization and bounding box regression loss. It has no inherent information about the specific type of CAPTCHA it's detecting. This design choice is deliberate, aiming to produce a more generalized detector capable of identifying diverse CAPTCHA layouts and potentially unseen CAPTCHA types in the future, without being biased by specific CAPTCHA service characteristics. The output of this stage is a set of bounding boxes indicating areas likely containing CAPTCHAs.

Recognition Stage

Once potential CAPTCHA regions are detected, the recognition stage takes these bounding boxes, crops out the corresponding image regions from the screenshot, and determines the exact type of CAPTCHA present. This stage faces two primary challenges:

1. Multimodal Representation Learning: CAPTCHAs often contain both textual and visual information. Therefore, the problem is modeled as a multimodal representation learning problem to effectively capture both types of features.
2. Diversity Handling: The model must handle:

• Intra-type diversity: Different challenge variants within the same CAPTCHA type (e.g., various reCAPTCHA challenges).
• Inter-type diversity: Potentially new and unseen CAPTCHA types that were not part of the initial training data.

• Model Architecture: To address these challenges, the researchers propose a deep Siamese model with a dual-branch architecture. One branch is dedicated to processing textual features, while the other processes visual features.
• Embedding Generation: Given a cropped CAPTCHA image as input, the model encodes the image into an N-dimensional embedding. This embedding represents the CAPTCHA's unique characteristics in a high-dimensional space.
• Type Identification: Once an embedding is generated, it is compared against a pre-established list of reference embeddings for known CAPTCHA types. The closest match in the embedding space determines the identified CAPTCHA type.
• Training Objective: The recognition model is trained using a metric learning training objective. The goal is to:
• Pull positive pairs (embeddings of the same CAPTCHA type) closer together in the embedding space.
• Push negative pairs (embeddings of different CAPTCHA types) further apart.
• Loss Function: Specifically, the Sub-Center ArcFace loss is employed as the objective function:
• ArcFace: This component ensures that the learned embeddings are distributed on a hypersphere with a defined radius s. This angular margin-based loss is particularly effective in addressing the inter-type diversity issue by enforcing clear separation between different CAPTCHA types.
• Sub-Center: This component accounts for the possibility that embeddings belonging to the same class (i.e., the same CAPTCHA type) could naturally form multiple clusters in the embedding space. This is crucial for handling intra-type diversity, where a single CAPTCHA service might present varied challenge formats (e.g., "select all squares with traffic lights" vs. "type the distorted text").

Solving Stage

With the CAPTCHA type identified, PhishDecloaker deploys the corresponding CAPTCHA solver. The system's modular nature allows it to be extended to support many new CAPTCHA services, but currently handles four distinct types: reCAPTCHA, hCaptcha, slider-based CAPTCHAs, and rotation-based CAPTCHAs. Each solver utilizes browser automation to interact with the live web page and complete the CAPTCHA challenge.

• reCAPTCHA and hCaptcha Solvers: For these widely used services, the solving problem is again modeled as an object detection problem. The solver identifies specific elements within the CAPTCHA challenge (e.g., images to select, checkboxes to click) and automates the required interactions.
• Slider-based CAPTCHA Solvers: These challenges often require dragging a puzzle piece into a specific gap. The solving mechanism is modeled as a template matching problem. It calculates the distance between the puzzle piece and the puzzle gap in the challenge image and then simulates the precise drag action required to complete the puzzle.
• Rotation-based CAPTCHA Solvers: These CAPTCHAs involve rotating an image to its correct orientation. This is modeled as a regression problem, where a specialized model predicts the exact degree of rotation required. Once the rotation angle is known, it is translated directly into a drag distance or rotational input to reorient the image and solve the challenge.

By successfully navigating these three stages, PhishDecloaker effectively bypasses the CAPTCHA, revealing the cloaked phishing content for subsequent analysis by a standard phishing detector.

Demo / Proof of Concept

▶ Watch: Solving diverse CAPTCHA types with specific models (5:30)

While the talk did not feature a live, interactive demonstration of PhishDecloaker, its effectiveness and practical utility were rigorously established through a comprehensive field study. This study served as a robust proof of concept, demonstrating PhishDecloaker's ability to operate in real-world conditions and yield tangible results in discovering zero-day phishing threats.

The researchers designed an experiment comprising six distinct study groups to assess PhishDecloaker's performance against existing and baseline detection methods. All study groups utilized the same underlying phishing detector, Fishpedia, ensuring a consistent evaluation baseline for identifying phishing content once de-cloaked. The differentiation among groups lay in the anti-cloaking techniques they were equipped with:

• Control Group: A baseline group with no special features.
• JavaScript Rendering Enabled Group: The control group with JavaScript rendering enabled, a common requirement for modern web analysis.
• Anti-Cloaking Technique Groups (3-5): Three groups each equipped with a different, unspecified type of anti-cloaking technique to handle various specialized phishing websites.
• PhishDecloaker Group (Group 6): This group was specifically equipped with PhishDecloaker's anti-CAPTCHA cloaking capabilities.

To populate the experiment, new domains were continuously and automatically crawled from Stream for a period of four weeks. These newly discovered domains were then fed to all six study groups for analysis. If any study group reported a domain as phishing, the researchers manually inspected the domain to verify the finding and track associated metrics.

Key metrics tracked during the field study included:

• Zero-Day Phishing Definition: A website was classified as "zero-day" if it had not been reported by VirusTotal at the time of the researchers' inspection, highlighting the discovery of novel threats.
• Time to Take Down: The total number of hours required for a reported phishing site to go offline.
• Time to Blacklist: The total number of hours required for the site to be blacklisted by any of the commonly used phishing detectors, including VirusTotal, Google Safe Browsing, and Microsoft SmartScreen.

The results of this extensive field study, as detailed in the "Key Findings" section, unequivocally demonstrated PhishDecloaker's superior ability to detect zero-day CAPTCHA-cloaked phishing websites, validate the prevalence of specific CAPTCHA types and API key reuse, and quantify the extended evasion period afforded by CAPTCHA cloaking. This empirical evidence serves as a compelling proof of concept for the system's efficacy in addressing a critical and previously unmitigated threat vector.

Defensive Implications

▶ Watch: Key findings: Increased zero-day phishing detection (8:00)

The findings presented by PhishDecloaker have profound implications for security defenders and organizations seeking to bolster their anti-phishing postures. The talk highlights significant shortcomings in current detection paradigms and offers actionable insights for improved defense.

1. Rethink Traditional Blacklisting and Static Analysis: The most striking defensive implication is the demonstrated ineffectiveness of traditional blacklist-based and static analysis tools against CAPTCHA-cloaked phishing. Leading services like VirusTotal, Google Safe Browsing, and Microsoft SmartScreen failed to detect any of the 500 CAPTCHA-cloaked kits in the researchers' study. This necessitates a shift towards more dynamic, interactive, and vision-based analysis techniques that can mimic human interaction.
2. Integrate Interactive, Vision-Based Detection: Organizations should consider integrating advanced systems capable of detecting, recognizing, and solving CAPTCHA challenges. Solutions similar to PhishDecloaker, which leverage machine learning for object detection, multimodal representation learning, and browser automation, are crucial for peeling back the layers of CAPTCHA cloaking and revealing the true nature of suspicious sites.
3. Monitor for CAPTCHA Type Prevalence: Defenders should be aware of the predominant CAPTCHA services favored by phishers. The study indicates a strong preference for reCAPTCHA and hCaptcha due to their free and convenient nature. Monitoring for the presence and specific configurations of these CAPTCHA types on suspicious domains could serve as an early warning signal.
4. Leverage CAPTCHA Service API Keys as IoCs: Perhaps the most actionable defensive insight is the identification of reused CAPTCHA service API keys as powerful Indicators of Compromise (IoCs). The Pareto distribution of key reuse means that a small number of API keys are associated with a disproportionately large number of CAPTCHA-cloaked phishing sites. Security teams should develop mechanisms to extract these API keys from suspicious sites and cross-reference them against known malicious keys or look for high-frequency reuse across disparate domains. A single compromised or widely reused API key can link numerous phishing campaigns, offering a potent detection vector.
5. Acknowledge Extended Evasion Periods: While CAPTCHA-cloaked sites may have a slightly shorter overall lifespan, the critical finding is that they evade blacklisting detectors for significantly longer periods (40% longer, or 11 additional hours). This extended window of undetected operation increases the risk of successful compromise. Defenders need to implement rapid response mechanisms and proactive detection to minimize this exposure time.
6. Adopt Layered Security with Dynamic Analysis: A robust anti-phishing strategy must involve layered defenses. This means not solely relying on static analysis or blacklists but augmenting them with dynamic analysis capabilities that can interact with web pages, execute JavaScript, and, most importantly, solve CAPTCHA challenges. Orchestrating these different detection components (e.g., using task priority queues and asynchronous processing as suggested for PhishDecloaker) can ensure both effectiveness and scalability.
7. Proactive Threat Intelligence: Organizations should actively engage in threat intelligence gathering related to new cloaking techniques. Understanding how attackers are evolving their evasion strategies, especially with techniques like CAPTCHA cloaking, is vital for developing adaptive defenses.

By incorporating these defensive implications, security teams can significantly enhance their ability to detect and mitigate the growing threat posed by CAPTCHA-cloaked phishing campaigns.

Key Takeaways

• CAPTCHA cloaking is a severe and unmitigated threat: Current leading anti-phishing tools (VirusTotal, Google Safe Browsing, Microsoft SmartScreen) are largely ineffective against CAPTCHA-cloaked phishing, allowing these malicious sites to operate undetected for extended periods.
• PhishDecloaker offers a comprehensive, hybrid vision-based solution: The system uses a three-stage approach (detection, recognition, solving) to automatically bypass CAPTCHAs and reveal hidden phishing content, acting as a crucial de-cloaking mechanism.
• Advanced AI techniques power the system: PhishDecloaker leverages sophisticated models like modified Faster R-CNN for generalized detection, a deep Siamese model with dual-branch architecture for multimodal recognition, and metric learning with Sub-Center ArcFace loss to handle diverse CAPTCHA types effectively.
• Field studies validate real-world efficacy: Empirical evidence shows PhishDecloaker discovers 7.6% more phishing websites and the most zero-day threats, particularly targeting cryptocurrency and social networking sectors, underscoring its practical value.
• Reused CAPTCHA API keys are powerful IoCs: A critical finding is the Pareto distribution of CAPTCHA service API key reuse, where a small number of keys link to a large proportion of cloaked phishing sites, offering a novel and effective indicator of compromise for detection.
• Evasion time is a major concern: Despite potentially shorter lifespans, CAPTCHA-cloaked sites evade blacklisting services for 40% longer (11 hours more) than ordinary phishing, highlighting a significant window of vulnerability for users.

About the Speaker(s)

The primary speaker for this presentation was Xiwen Teoh, representing the National University of Singapore. He was joined in this research by co-authors Yun Lin and Ruofan Liu. Their work on PhishDecloaker demonstrates their expertise in cutting-edge security research, particularly in the domain of anti-phishing technologies and the application of advanced machine learning and computer vision techniques to combat evolving cyber threats. Their contributions are focused on developing robust and scalable solutions to address complex problems in web security, such as the persistent challenge of phishing and sophisticated cloaking mechanisms.