I still can't identify: deferred rendering can defeat visual phishing detectors

The paper proposes an evasion attack based on delayed rendering that can cause visual phishing webpage detectors to misclassify phishing pages as normal pages; the authors report reducing the detection rate from 100% to 0% on advanced detectors. Such detectors must first screenshot the target webpage and then compute its visual similarity to legitimate pages; the attacker delays the rendering of key elements such as the logo so that they appear in full only after the screenshot. A user study shows that end users cannot reliably identify these modifications (p<.05). The authors also propose mitigations, including a browser extension that does not call remote services, used to alert users that they may have landed on a phishing page.