Abstract:In an era dominated by digital interactions, phishing campaigns have evolved to exploit not just technological vulnerabilities but also human traits. This study takes an unprecedented deep dive into large-scale phishing campaigns aimed at Meta's users, offering a dual perspective on the technical mechanics and human elements involved. Analysing data from over 25,000 victims worldwide, we highlight the nuances of these campaigns, from the intricate techniques deployed by the attackers to the sentiments and behaviours of those targeted. Unlike prior research conducted in controlled environments, this investigation capitalises on the vast, diverse, and genuine data extracted directly from active phishing campaigns, allowing for a more holistic understanding of the drivers, facilitators, and human factors. Through applying advanced computational techniques, including natural language processing and machine learning, this work unveils critical insights into the psyche of victims and the evolving tactics of modern phishers. Our analysis illustrates very poor password selection choices from the victims, with 30.27% of them picking low-complexity passwords and 58.23% reusing leaked passwords. Additionally, more than 10% exhibit strong persistence in re-victimisation by posting again to the phishing platforms of the same phishers. Finally, we reveal many correlations regarding demographics and the time periods when victims are more vulnerable during the day, as well as analyse the sentiment, emotion, and tone of text responses that they submitted, illustrating how convinced they were of the scam.

Phishing and Spear Phishing: examples in Cyber Espionage and techniques to protect against them

SOK: A Comprehensive Reexamination of Phishing Research from the Security Perspective

Multilayer Approach to Defend Phishing Attacks

Some Recommended Protection Technologies for Cyber Crime Based on Social Engineering Techniques -- Phishing

Analysis of Phishing Attacks and Countermeasures

Discover and Automate New Adversarial Attack Paths to Reduce Threat Risks for The Security of Organizations

Study on Phishing Attack Behaviours and Defence Model

Breaching the Human Firewall: Social engineering in Phishing and Spear-Phishing Emails

Defending against Phishing Attacks: Taxonomy of Methods, Current Issues and Future Directions

Protection Against Phishing Attacks: A Survey

Phishing - A Growing Threat to E-Commerce

A Survey on the Principles of Persuasion as a Social Engineering Strategy in Phishing

The Anatomy of Deception: Measuring Technical and Human Factors of a Large-scale Phishing Campaign

The Anatomy of Deception: Technical and Human Perspectives on a Large-scale Phishing Campaign

Phishing Attacks: Detection And Prevention

An Exploration Of The Design Features Of Phishing Attacks

Implementing a Web Browser with Phishing Detection Techniques

SoK: Human-Centered Phishing Susceptibility

That Ain't You: Detecting Spearphishing Emails Before They Are Sent

Exploring Historical and Emerging Phishing Techniques and Mitigating the Associated Security Risks

Walkthrough phishing detection techniques