Characterizing Phishing Pages by JavaScript Capabilities

Phishers achieve large-scale attacks by using ready-to-deploy phishing websites (phishing kits) to rapidly launch campaigns that leverage specific data exfiltration, evasion, or mimicry techniques. In contrast, researchers and defenders continue to rely on manual analysis to identify features for kit fingerprinting. In this paper, we examine the link between a page's client-side behavior and the underlying phishing kit used, enabling automated aggregation of phishing pages. Our key insight is that client-side techniques make heavy use of browser APIs, which, in turn, differentiate underlying kits based on their feature sets. Using an instrumented browser and a URL fuzzing utility, we collected traces from 1,328,917 pages and recovered kit archives for 4,180 pages between August 2023 and January 2025. For the labeled subset, we find that clustering based on the set of browser APIs executed yields 98% accuracy in grouping them by the underlying kit. We also find that 434,495 phishing pages execute enough browser APIs to cluster into 9,306 clusters, compressing multi-lingual phishing pages across various domains into a single cluster. Our findings show that analysts and researchers can leverage the complexity of client-side phishing code to track phishers' kit deployments in the wild.