When, in January 2017, Mozilla and Google made Firefox^[1] and Chrome^[2] flag HTTP login pages as insecure, the intent was to make phishing pages easier to recognize, as well as push more website owners towards deploying HTTPS.

But while the latter aim was achieved, and the number of phishing sites making use of HTTPS has increased noticeably, the move also had one unintended consequence: the number of phishing sites with HTTPS has increased, too.

“While the majority of today’s phishing sites still use the unencrypted HTTP protocol, a threefold increase in HTTPS phishing sites over just a few months is quite significant,” noted^[3] Netcraft’s Paul Mutton.

One explanation may be that fraudsters have begun setting up more phishing sites that use secure HTTPS connections.

Another may be that they have simply continued compromising websites to set up the phishing pages, but as more legitimate sites began using HTTPS, more phishing pages ended up having HTTPS. Finally, it’s possible that fraudsters are intentionally compromising HTTPS sites so that their phishing login pages look more credible.

Whatever the reason – and it might simply be a combination of them all – the change made some phishing attempts even more effective. And so the battle between attackers and defenders continues.

References

1. ^{^} Firefox (www.helpnetsecurity.com)
2. ^{^} Chrome (www.helpnetsecurity.com)
3. ^{^} noted (news.netcraft.com)