Phishcatcher 2.0: Real-Time Adaptive Client -Side Defense Against Sophisticated Web Spoofing Attacks

The emergence of sophisticated web-spoofing attacks, such as phishing sites, login page spoofing, Browser-in-the-Browser (BiTB) attacks, and visual brand mimicry, has made the web a perilous place. Both conventional and rule-driven client-side solutions have shown limited effectiveness against zero-day and dynamic obfuscation attacks, while many deep learning-based approaches suffer from low real-time efficiency. In this context, the objective of our paper is to propose PHISHCATCHER 2.0, an adaptive, real-time client-side system to defend web users against sophisticated web-spoofing attacks. PHISHCATCHER 2.0 combines conventional machine learning models (Random Forest (RF), Support Vector Machine (SVM), XGBoost, and SGDClassifier) as benchmark models with a new Convolutional Neural Network and Bi-directional Long Short-Term Memory (CNN-BiLSTM) Network model variant as the main phishing detection module. The role of the CNN part of this module is to capture detailed patterns in URLs, DOM, and injected scripts from phishing sites, while the Bi-LSTM handles any type of sequential patterns, including redirect paths and page transformations performed by phishing sites. To address ever-evolving phishing attacks, this phishing prevention framework integrates Cloud-Assisted Learning (CAL), enabling adaptive learning on phishing sites without sacrificing client-side latency. Experiments indicate that the designed CNN-BiLSTM model achieves 99.20% accuracy, 99.00% precision, 99.27% recall, and 99.20% F1-measure, while maintaining a suitable inference latency for real-time browser protection systems.