  Phishing attacks attempt to deceive users into stealing sensitive
information, posing a significant cybersecurity threat. Advances in machine
learning (ML) and deep learning (DL) have led to the development of numerous
phishing webpage detection solutions, but these models remain vulnerable to
adversarial attacks. Evaluating their robustness against adversarial phishing
webpages is essential. Existing tools contain datasets of pre-designed phishing
webpages for a limited number of brands, and lack diversity in phishing
features.
  To address these challenges, we develop PhishOracle, a tool that generates
adversarial phishing webpages by embedding diverse phishing features into
legitimate webpages. We evaluate the robustness of two existing models, Stack
model and Phishpedia, in classifying PhishOracle-generated adversarial phishing
webpages. Additionally, we study a commercial large language model, Gemini Pro
Vision, in the context of adversarial attacks. We conduct a user study to
determine whether PhishOracle-generated adversarial phishing webpages deceive
users. Our findings reveal that many PhishOracle-generated phishing webpages
evade current phishing webpage detection models and deceive users, but Gemini
Pro Vision is robust to the attack. We also develop the PhishOracle web app,
allowing users to input a legitimate URL, select relevant phishing features and
generate a corresponding phishing webpage. All resources are publicly available
on GitHub.
