Phishing detection is broken: Why most attacks feel like a zero day

The report argues that modern phishing attacks routinely evade IoC- and email/proxy-based defenses by rotating domains and URLs, using one-time links, leveraging bot checks, delivering across multiple channels, and rendering dynamic, obfuscated pages that resist sandboxing. It contends that effective defense requires real-time, in-browser visibility to detect page and user behaviors (e.g., credential entry on cloned login pages, phishing toolkits) and enforce immediate controls, and promotes a browser-based identity security approach to stop MFA-bypass phishing, credential stuffing, and session hijacking.