Demystifying the Regional Phishing Landscape in South Korea

The ever-increasing phishing campaigns around the globe have been one of the main threats in cyber security. In response, the global anti-phishing entity ( e.g ., APWG) collectively maintains the up-to-date blacklist database ( e.g ., eCrimeX) against phishing campaigns, and so do modern browsers ( e.g ., Google Safe Browsing). However, our finding reveals that such a mutual assistance system has been remaining a blind spot when detecting geolocation-based phishing campaigns. In this paper, we focus on phishing campaigns against the web portal service with the largest number of users (42 million) in South Korea. We harvest 1,558 phishing URLs from varying resources in the span of a full year, of which only a small fraction (3.8%) have been detected by eCrimeX despite a wide spectrum of active fraudulence cases. We demystify three pervasive types of phishing campaigns in South Korea: i) sophisticated phishing campaigns with varying adversarial tactics such as a proxy configuration, ii) phishing campaigns against a second-hand online market, and iii) phishing campaigns against a non-specific target. Aligned with previous findings, a phishing kit that supports automating the whole phishing campaign is prevalent. Besides, we frequently observe a hit-and-run scam where a phishing campaign is immediately inaccessible right after victimization is complete, each of which is tailored to a single potential victim over a new channel like a messenger. As part of mitigation efforts, we promptly provide regional phishing information to APWG, and immediately lock down a victim’s account to prevent further damages.