{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-08-10-008",
    "source_story_id": "tmp-story-phishkits-code-reuse",
    "edition_id": "mp-2026-08-10-morning-0032",
    "edition_url": "https://themachinepress.com/edition/2026-08-10",
    "position": 8,
    "story_type": "dispatch",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "Most Phishing Kits Reused the Same Tricks",
    "slug": "most-phishing-kits-reused-the-same-tricks",
    "dek": "A study of 1,300 kits found substantial component reuse—and 21.8 percent used no evasion mechanism at all.",
    "summary": "A study of 1,300 kits found substantial component reuse—and 21.8 percent used no evasion mechanism at all.",
    "body_text": "Researchers examined phishkits collected from 2020 through 2023, including their code, communication channels and data-exfiltration behavior. They found dynamic redirection and traffic attribution mechanisms, plus frequent use of messaging services to receive stolen data. Yet 284 of 1,300 kits used no evasion, and major components were often similar or identical across samples. The authors argue this predictability could support detection at scale; the preprint does not describe a current named campaign.",
    "why_it_matters": "A study of 1,300 kits found substantial component reuse—and 21.8 percent used no evasion mechanism at all.",
    "limitations": [
      "The authors argue this predictability could support detection at scale; the preprint does not describe a current named campaign."
    ],
    "importance": 8,
    "canonical_url": "https://themachinepress.com/story/mp-2026-08-10-008/most-phishing-kits-reused-the-same-tricks",
    "json_url": "https://themachinepress.com/story/mp-2026-08-10-008.json",
    "first_published_at": "2026-08-10T09:00:00.000-04:00",
    "modified_at": "2026-08-10T15:50:00.000-04:00",
    "content_status": "new",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-08-10-008-001",
        "text": "A study of 1,300 kits found substantial component reuse—and 21.8 percent used no evasion mechanism at all.",
        "source_ids": [
          "source-2026-08-10-008"
        ],
        "qualification": "The authors argue this predictability could support detection at scale; the preprint does not describe a current named campaign."
      }
    ],
    "source_ids": [
      "source-2026-08-10-008"
    ],
    "tags": [
      "phishing",
      "cybersecurity",
      "malware analysis"
    ],
    "image_url": "https://themachinepress.com/issues/2026-08-10/phishkits-cyber-file-image.webp",
    "corrections": []
  },
  "sources": [
    {
      "source_id": "source-2026-08-10-008",
      "title": "arXiv preprint 2608.07451",
      "publisher": "arXiv",
      "url": "https://arxiv.org/abs/2608.07451",
      "canonical_url": "https://arxiv.org/abs/2608.07451",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": "2026-08-07T13:00:00.000-04:00",
      "accessed_at": "2026-08-10T15:30:00.000-04:00",
      "supports_claim_ids": [
        "claim-mp-2026-08-10-008-001"
      ]
    }
  ],
  "corrections": [],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "Most Phishing Kits Reused the Same Tricks",
    "publisher": "The Machine Press",
    "published_at": "2026-08-10T09:00:00.000-04:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-08-10-008/most-phishing-kits-reused-the-same-tricks"
  }
}