• 1 min read

How AI-powered phishing killed blocklists for good

AI is helping attackers create disposable phishing infrastructure and rapidly evolving toolkits that blocklists cannot track fast enough. Push Security explains why browser-level, technique-based detection offers a more durable defense t…

What happened

Recent reporting highlighted how ai-powered phishing killed blocklists for good. Blocklists were already losing ground before AI entered the picture. Attackers are using AI to generate phishing pages from screenshots in minutes, spin up and tear down infrastructure faster than any blocklist can track, and iterate on tooling at a cadence that makes indicator-based detection functionally useless.

Why it matters

This matters because AI-related risk increasingly shows up through deployment choices, interfaces, and governance gaps rather than model headlines alone. It also helps frame how defenders should think about attacker adaptation and recurring tradecraft rather than single incidents in isolation.

Assessment

The strongest signal here is the tradecraft pattern and what it says about attacker adaptation, not just the single campaign or disclosure. In practice, that means cloud-adjacent control planes, shared services, and inherited trust assumptions deserve more scrutiny than many organisations currently give them.

  • Check whether cloud services, connectors, or shared administrative paths create avoidable trust-boundary risk
  • Map the observed activity to existing detections and threat-hunting hypotheses instead of tracking it only as narrative reporting
  • Monitor follow-on reporting or primary-source updates for scope expansion, implementation guidance, or stronger enforcement signals

Further reading