Phishing Experiments in the Wild: Lessons for Ubiquitous and Context-Aware Security

Phishing remains a pervasive social engineering threat, undermining users across ubiquitous and interconnected computing environments. Unlike traditional exploits, phishing adapts dynamically, leveraging emotional triggers, urgency, and high-fidelity mimicry to bypass technical defenses. This paper reports on phishing experiments conducted in the wild, designed to capture unprimed user behavior under realistic conditions rather than laboratory constraints. Data collection occurred during the COVID-19 pandemic, providing a natural context of heightened uncertainty that parallels attacker exploitation strategies. Three contributions are emphasized. First, we present empirical evidence of susceptibility and lure effectiveness under authentic delivery constraints, documenting how adaptive spam filters shaped exposure over time. Second, we analyze methodological lessons, including the decision to abandon tracking-pixel “opens” in favor of unique-token click-throughs, aligning with recent cautions about automated prefetching and measurement bias. Third, we evaluate the ethical and legal considerations of deception-based fieldwork, situating safeguards within the Menlo framework and recent critiques of IRB sufficiency. The findings highlight that in ubiquitous computing environments, resilience depends not only on end-user awareness but also on system-level factors such as filtering dynamics, crowd-sourced detection, and measurement robustness. Lessons from this case study provide guidance for researchers and practitioners designing context-aware, humancentered defenses in pervasive systems.