<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-05065623</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-15T22:07:03+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">A Closer Look At Modern Evasive Phishing Emails</title>
            <author role="aut">
              <persName>
                <forename type="first">Elyssa</forename>
                <surname>Boulila</surname>
              </persName>
              <idno type="halauthorid">3522095-0</idno>
              <affiliation ref="#struct-421532"/>
              <affiliation ref="#struct-41318"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Marc</forename>
                <surname>Dacier</surname>
              </persName>
              <idno type="halauthorid">135199-0</idno>
              <affiliation ref="#struct-104346"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Siva Prem</forename>
                <surname>Vengadessa Peroumal</surname>
              </persName>
              <idno type="halauthorid">3522096-0</idno>
              <affiliation ref="#struct-41318"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Nicolas</forename>
                <surname>Veys</surname>
              </persName>
              <idno type="halauthorid">3522097-0</idno>
              <affiliation ref="#struct-41318"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Simone</forename>
                <surname>Aonzo</surname>
              </persName>
              <idno type="halauthorid">1728799-0</idno>
              <affiliation ref="#struct-421532"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Centre De Documentation</forename>
                <surname>Eurecom</surname>
              </persName>
              <email type="md5">808fb6c747947adf4fb3953c09dd1636</email>
              <email type="domain">eurecom.fr</email>
            </editor>
            <funder ref="#projanr-69632"/>
            <funder ref="#projanr-109421"/>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2025-05-13 14:11:56</date>
              <date type="whenModified">2025-11-14 16:58:02</date>
              <date type="whenReleased">2025-05-15 08:39:09</date>
              <date type="whenProduced">2025-06-23</date>
              <date type="whenEndEmbargoed">2025-05-13</date>
              <ref type="file" target="https://hal.science/hal-05065623v1/document">
                <date notBefore="2025-05-13"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-05065623v1/file/publi-8200.pdf" id="file-5065623-4383406">
                <date notBefore="2025-05-13"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="118606">
                <persName>
                  <forename>Centre De Documentation</forename>
                  <surname>Eurecom</surname>
                </persName>
                <email type="md5">808fb6c747947adf4fb3953c09dd1636</email>
                <email type="domain">eurecom.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-05065623</idno>
            <idno type="halUri">https://hal.science/hal-05065623</idno>
            <idno type="halBibtex">boulila:hal-05065623</idno>
            <idno type="halRefHtml">&lt;i&gt;DSN 2025, 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks&lt;/i&gt;, IEEE/IFIP, Jun 2025, Naples, Italy</idno>
            <idno type="halRef">DSN 2025, 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, IEEE/IFIP, Jun 2025, Naples, Italy</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-5065623-4383406"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="EURECOM">EURECOM</idno>
            <idno type="stamp" n="ANR">ANR</idno>
            <idno type="stamp" n="CYBERSCURITE">PEPR Cybersécurité</idno>
            <idno type="stamp" n="DEFMAL">DEFMAL</idno>
            <idno type="stamp" n="ANR-IA-23" corresp="ANR-IA">ANR-IA-23</idno>
            <idno type="stamp" n="ANR-IA">ANR-IA</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="0">No</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">A Closer Look At Modern Evasive Phishing Emails</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Elyssa</forename>
                    <surname>Boulila</surname>
                  </persName>
                  <idno type="halauthorid">3522095-0</idno>
                  <affiliation ref="#struct-421532"/>
                  <affiliation ref="#struct-41318"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Marc</forename>
                    <surname>Dacier</surname>
                  </persName>
                  <idno type="halauthorid">135199-0</idno>
                  <affiliation ref="#struct-104346"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Siva Prem</forename>
                    <surname>Vengadessa Peroumal</surname>
                  </persName>
                  <idno type="halauthorid">3522096-0</idno>
                  <affiliation ref="#struct-41318"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Nicolas</forename>
                    <surname>Veys</surname>
                  </persName>
                  <idno type="halauthorid">3522097-0</idno>
                  <affiliation ref="#struct-41318"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Simone</forename>
                    <surname>Aonzo</surname>
                  </persName>
                  <idno type="halauthorid">1728799-0</idno>
                  <affiliation ref="#struct-421532"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>DSN 2025, 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks</title>
                  <date type="start">2025-06-23</date>
                  <date type="end">2025-06-26</date>
                  <settlement>Naples</settlement>
                  <country key="IT">Italy</country>
                </meeting>
                <respStmt>
                  <resp>conferenceOrganizer</resp>
                  <name>IEEE/IFIP</name>
                </respStmt>
                <imprint/>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">cloaking</term>
                <term xml:lang="en">crawler</term>
                <term xml:lang="en">phishing</term>
              </keywords>
              <classCode scheme="classification">DSN</classCode>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>The prevalence of sophisticated evasion techniques employed by phishing attacks in circumventing anti-phishing and email security measures is on the rise. The present study offers an exhaustive analysis of user-reported phishing messages pertaining to five companies over a ten-month period. These messages are of particular interest as they evaded all state of the art security layers in place and were identified by the recipients themselves.&lt;/p&gt;&lt;p&gt;To study these elusive phishing attempts, we developed an analysis infrastructure, CrawlerBox, designed to overcome cloaking tactics that exploit browser fingerprinting and bot detection challenges. CrawlerBox is made available as an open-source tool to assist other researchers in pursuing further studies.&lt;/p&gt;&lt;p&gt;Over the course of ten months, we gathered 1,551 user-reported messages that were confirmed to be malicious, with a particular focus on those targeting the harvesting of corporate credentials. Our analysis infrastructure enabled us to scan these messages and crawl any associated web resources, including URLs, embedded HTML, and JavaScript content.&lt;/p&gt;&lt;p&gt;Our findings indicate that the majority of observed phishing attacks are low-volume but meticulously planned, exhibiting a high degree of premeditation and strategic preparation. In particular, a substantial number of sites were registered and had obtained TLS certificates several weeks before the attacks in order to avoid being flagged based on their young age, a common practice used by products to defeat phishing websites. Furthermore, it was observed that phishing pages are now safeguarded by advanced evasion mechanisms, such as bot detection services and opensource fingerprinting libraries. Notably, QR codes are increasingly used to embed phishing content. The victim needs to use a personal phone to flash the code and access the site; this activity will typically fall outside the perimeter of the corporate security defenses. These findings underscore the evolving sophistication of phishing threats and the urgent need for resilient systems to counter these advanced techniques, further emphasizing the critical role of robust infrastructures like CrawlerBox in enhancing the security and dependability of email systems.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-421532" status="VALID">
          <orgName>Eurecom [Sophia Antipolis]</orgName>
          <desc>
            <address>
              <addrLine>Campus SophiaTech, 450 Route des Chappes, CS 50193 - 06904 Biot Sophia Antipolis cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.eurecom.fr/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-41318" status="VALID">
          <orgName>Amadeus</orgName>
          <desc>
            <address>
              <addrLine>Nice</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.amadeus.com/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-310081" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-104346" status="VALID">
          <idno type="IdRef">253849586</idno>
          <idno type="ROR">https://ror.org/01q3tbs38</idno>
          <orgName>King Abdullah University of Science and Technology [Thuwal, Saudi Arabia]</orgName>
          <orgName type="acronym">KAUST</orgName>
          <date type="start">2009-01-01</date>
          <desc>
            <address>
              <addrLine>King Abdullah University of Science and Technology P.O.Box 55455 Jeddah 21534, Saudi Arabia</addrLine>
              <country key="SA"/>
            </address>
            <ref type="url">http://www.kaust.edu.sa/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-310081" status="INCOMING">
          <orgName>Amadeus</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
      </listOrg>
      <listOrg type="projects">
        <org type="anrProject" xml:id="projanr-69632" status="VALID">
          <idno type="anr">ANR-22-PECY-0007</idno>
          <orgName>Defmal</orgName>
          <desc>Defense against malware</desc>
          <date type="start">2022</date>
        </org>
        <org type="anrProject" xml:id="projanr-109421" status="VALID">
          <idno type="anr">ANR-23-IAS4-0001</idno>
          <orgName>CKRISP</orgName>
          <desc>Représentation des connaissances à plusieurs niveaux et raisonnement causal pour une compréhension et une prédiction interprétables des incidents de sécurité</desc>
          <date type="start">2023</date>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>