Search papers, labs, and topics across Lattice.
TraceScope is introduced as a decoupled URL triage pipeline designed to combat modern phishing campaigns that evade traditional classifiers by using interaction gates and delayed content rendering. It employs a sandboxed operator agent to interact with URLs and generate immutable evidence bundles, which are then analyzed by an adjudicator agent that uses a MITRE ATT&CK checklist to verify malicious behavior. Evaluated on both existing datasets and a newly curated real-world phishing dataset, TraceScope demonstrates improved recall and precision compared to existing methods, particularly in detecting sophisticated phishing attempts.
Current defenses are failing against sophisticated phishing attacks, but TraceScope's decoupled, interactive triage pipeline achieves superior detection by mimicking analyst workflows and generating analyst-grade evidence.
Modern phishing campaigns increasingly evade snapshot-based URL classifiers using interaction gates (e.g., checkbox/slider challenges), delayed content rendering, and logo-less credential harvesters. This shifts URL triage from static classification toward an interactive forensics task: an analyst must actively navigate the page while isolating themselves from potential runtime exploits. We present TraceScope, a decoupled triage pipeline that operationalizes this workflow at scale. To prevent the observer effect and ensure safety, a sandboxed operator agent drives a real GUI browser guided by visual motivation to elicit page behavior, freezing the session into an immutable evidence bundle. Separately, an adjudicator agent circumvents LLM context limitations by querying evidence on demand to verify a MITRE ATT&CK checklist, and generates an audit-ready report with extracted indicators of compromise (IOCs) and a final verdict. Evaluated on 708 reachable URLs from existing dataset (241 verified phishing from PhishTank and 467 benign from Tranco-derived crawling), TraceScope achieves 0.94 precision and 0.78 recall, substantially improving recall over three prior visual/reference-based classifiers while producing reproducible, analyst-grade evidence suitable for review. More importantly, we manually curated a dataset of real-world phishing emails to evaluate our system in a practical setting. Our evaluation reveals that TraceScope demonstrates superior performance in a real-world scenario as well, successfully detecting sophisticated phishing attempts that current state-of-the-art defenses fail to identify.
