Cloaking-as-a-service set to reshape the phishing landscape

Imagine if hackers could give their scam websites a cloak of invisibility, showing one web page to regular people and a harmless page to security scans. Sneaky, huh?

According to new research from SlashNext that’s essentially what’s happening as cybercriminals start to leverage AI-powered cloaking services to shield phishing pages, fake stores, and malware sites from prying eyes.

By presenting harmless content to automated reviews and a scam to real users, fraudsters can keep malicious sites running under the radar. Cybercriminals are treating their web infrastructure with the same sophistication as their malware or phishing emails, investing in AI-driven traffic filtering to protect their scams.

Cloaking isn’t new of course. Years ago, shady online advertisers used it to dodge site rules. In late 2024, Google’s Trust and Safety team warned that criminals were now doing the same thing -- only with AI, which makes the trick much harder to spot. We’re also now seeing an emerging ecosystem of cloaking-as-a-service providers. These services package advanced detection evasion techniques --JavaScript fingerprinting, device and network profiling, machine learning analysis, and dynamic content swapping -- into user-friendly platforms that anyone (including criminals) can subscribe to.

Hoax Tech, for example, is an online service that hides bad sites by reading tiny clues on a visitor’s device, a trick called JavaScript fingerprinting (a quick scan of your screen size, browser, and other digital ‘fingerprints’) and by using machine learning to spot patterns. Originally created for affiliate marketers running gray (policy-violating) offers, Hoax Tech’s technology is now being repurposed to defend phishing and scam sites from discovery.

Mayuresh Dani, security research manager, at the Qualys Threat Research Unit, says “This research presents a critical evolution in the cyberthreat landscape demanding an immediate attention from security teams and organizations. It always has been an arms race between attackers and defenders. This research reveals a sophistication leap that threat actors are now leveraging artificial intelligence to fundamentally improve their evasion capabilities.”

You can read more, with examples of how cloaking works, on the SlashNext blog.

Image credit: Ghavam Cheraghali/Unsplash