Stopping the Next Generation of Phishing Attacks

The Evolution of Real-time Attack Orchestration

As security defenses have evolved, more advanced phishing scenarios have emerged. Attackers are moving away from the collection of static credentials, to the use of dynamic bots designed to break into accounts in real time and even defeat multi-factor authentication (MFA). In these scenarios, they will prompt users for an MFA code when they login to a fake site, and use automation to pass on all the credentials and the MFA token while it is still valid.

The downstream monetization of these hacked accounts varies significantly depending on the industry. Banking and fintech accounts are particularly high targets, due to the potential to access funds, and are often the first target for these more advanced phishing attempts. However, attackers have honed in on monetizing hacked accounts in all industries; for example, even online gaming accounts can be resold for thousands of dollars.

Arkose Labs Against Automated Phishing Attacks

The Arkose Fraud Deterrence Platform provides multi-layered defense against advanced, persistent attacks on user accounts. It is backed by a commercial guarantee on the efficacy of the solution, with a promise to defeat the automated login attacks that advanced phishing relies on.

Sophisticated Anti-Bot Defense at Login

Arkose Labs has extensive protections against advanced bots, thwarting the automated scripts that use phished credentials in real time. Sophisticated risk decisioning detects anomalous activity using real-time signals and historical attack pattern calibration. High risk activity is presented with interactive, anti-automation challenges that are designed against the latest machine learning techniques.

Dynamic Arkose Labs Token

Integrating Arkose Labs into the login touchpoint thwarts automated phishing by embedding a token in the legitimate web application or SDK. Each request dynamically verifies that the token has passed from the client to the server, causing sessions originating from a phishing website to fail.

Detecting Phishing Sites

By requiring that all logins have a valid Arkose Labs session token, attackers are forced to integrate Arkose Labs into their phished landing pages in order to generate a session token. However, Arkose Labs is designed to detect any traffic originating from non-legitimate sites, providing businesses with visibility into traffic from non-primary domains.