Coupling Constants as Conserved Charges
in Black Hole Thermodynamics

Kamal Hajian†∗111kamal.hajian<EMAIL_ADDRESS>and
Bayram<EMAIL_ADDRESS>
†Institute of Physics, University of Oldenburg, P.O.Box 2503, D-26111
Oldenburg, Germany
∗Department of Physics, Middle East Technical University, 06800, Ankara,
Turkey

In a generic theory of gravity coupled to matter fields, the Smarr formula and
the first law of thermodynamics of black holes do not work properly if the
contributions of the coupling constants defining the theory are not
incorporated. However, these couplings, such as the cosmological constant or
the dimensionful parameters that appear in the Lagrangian, are fixed
parameters defining the theory; and they cannot be varied. Here, we present a
robust method, applicable to any covariant Lagrangian, that changes the role
of the couplings from the constants in a theory to the free parameters in
solutions. To this end, for each one of the couplings in a theory, a pair of
auxiliary scalar and gauge fields is introduced. The couplings are shown to be
conserved charges of the global part of the implemented gauge symmetry.
Besides, their conjugate chemical potentials are defined as the electric
potential of the corresponding gauge fields on the black hole horizon. Using
this method, we systematically extend the first law and the Smarr formula by
coupling conserved charges and their conjugate potentials. The thermodynamics
of a black hole solution in a quadratic gravity theory is given as an example.

##  1 Introduction

In the last decades, the cosmological constant $\Lambda$ [2] has been the
focus of astronomical observations [3, 4] as well as theoretical research such
as the AdS/CFT correspondence [5, 6] and the black hole thermodynamics [7, 8,
9] and chemistry [10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23]. It
has been understood in the black hole chemistry context that its variation has
to be included in the black hole first law in order to have a consistent Smarr
formula [24]. However, by fiat, it is a constant in the Lagrangian and not a
property of a particular solution (such as the mass or the charge or angular
momentum of the solution). Thus, it is not clear how it can be varied to fit
into the first law of black hole thermodynamics. Besides, its conjugate
chemical potential lacks a firm geometrical prescription as a volume. As a
remedy, the Lagrangian can be modified by an auxiliary gauge field[25, 26, 27,
28] such that the $\Lambda$ changes its role to be the conserved charge of the
induced gauge symmetry and hence a parameter in the solution. In addition, its
conjugate is defined naturally as the horizon gauge potential [29, 30].

The Smarr formula is democratic as far as the coupling constants other than
$\Lambda$ are considered and cannot be satisfied unless other couplings are
also included in the black hole thermodynamics. It suggests a general
formulation that can capture all couplings as conserved charges in black hole
physics. In this paper, we provide a modification of the Lagrangian that can
put the black hole chemistry with all couplings on firm ground.

The paper is organized as follows: In the next section, pairs of auxiliary
fields are introduced in the Lagrangian, which allows one to interpret the
coupling constants as parameters in the solutions. In Section 3, we show that
the couplings are conserved charges. Section 4 is devoted to introducing
conjugate chemical potentials. The first law of black hole thermodynamics and
the Smarr formula are extended in Section 5. In the last section, a clarifying
example, which is a well-studied, 3D higher curvature gravity, is given to
show the validity of our approach.

##  2 Couplings as solution parameters

In a $D$-dimensional space-time, we consider the action

$I=\int\mathrm{d}^{D}x\sqrt{-g}\mathcal{L},\qquad\mathcal{L}=\mathcal{L}_{0}-\sum_{i}\alpha_{i}\mathcal{L}_{i},$
(1)

where $\mathcal{L}_{0}$ is Lagrangian that includes the kinetic term and comes
with no coupling constant such as the Einstein-Hilbert term (Newton’s constant
is set to unity, or it multiplies the whole action); and $\mathcal{L}_{i}$’s
are some number of other Lagrangian densities labeled by index $i$ that are
coupled with the corresponding coupling constant $\alpha_{i}$. The densities
can be, e.g., the (cosmological) constant term, higher curvatures, scalar
tensor theories, Maxwell gauge fields, and in general, any covariant term that
is built of the metric $g_{\mu\nu}$, curvature $R^{\alpha}_{\,\,\beta\mu\nu}$,
covariant derivative $\nabla_{\mu}$, and other dynamical fields in the theory.
The action (1) can be conventionally re-written in terms of the volume
$D$-form $\boldsymbol{\epsilon}$, i.e.,

$\boldsymbol{\epsilon}=\dfrac{\sqrt{-g}}{D!}\epsilon_{\mu_{1}\dots\mu_{D}}\mathrm{d}x^{\mu_{1}}\wedge\dots\wedge\mathrm{d}x^{\mu_{D}},\qquad
I=\int\mathbf{L}=\int\left(\mathbf{L}_{0}-\sum_{i}\alpha_{i}\mathbf{L}_{i}\right),$
(2)

where we defined the $D$-forms as

$\mathbf{L}\equiv\mathcal{L}\boldsymbol{\epsilon},\qquad\mathbf{L}_{0}\equiv\mathcal{L}_{0}\boldsymbol{\epsilon},\qquad\mathbf{L}_{i}\equiv\mathcal{L}_{i}\boldsymbol{\epsilon}$
(3)

with $\epsilon_{01\dots D-1}=+1$ for the Levi-Civita symbol. Variation of
$\mathbf{L}$ with respect to all dynamical fields, collectively denoted by
$\Phi(x)$ including the metric $g_{\mu\nu}$, yields

$\delta\mathbf{L}=\boldsymbol{\mathrm{E}}^{\Phi}\delta\Phi+\mathrm{d}\boldsymbol{\Theta}$
(4)

in which the summation convention over the fields should be understood.
Setting $\delta\mathbf{L}=0$ yields the field equations
$\boldsymbol{\mathrm{E}}^{\Phi}=0$ associated with each one of the fields in
the set $\Phi$; appropriate boundary conditions must also be provided for the
well-posedness of the problem. We note that $\boldsymbol{\mathrm{E}}^{\Phi}$
and $\boldsymbol{\Theta}$ are linear in terms of the Lagrangian components:
namely

$\boldsymbol{\mathrm{E}}^{\Phi}\delta\Phi=\left(\boldsymbol{\mathrm{E}}^{\Phi}_{0}-\sum_{i}\alpha_{i}\boldsymbol{\mathrm{E}}^{\Phi}_{i}\right)\delta\Phi,\qquad\boldsymbol{\Theta}=\boldsymbol{\Theta}_{0}-\sum_{i}\alpha_{i}\boldsymbol{\Theta}_{i}.$
(5)

It is possible to introduce pairs of auxiliary fields in the Lagrangian in
order to promote $\alpha_{i}$’s to be free parameters in the solution, not the
theory. Each pair, labeled also by the index $i$, is composed of one scalar
field denoted by $\alpha_{i}(x)$ and one ($D-1$)-form gauge field
$\boldsymbol{\mathrm{A}}_{i}$. The field strength
$\boldsymbol{\mathrm{F}}_{i}\equiv\mathrm{d}\boldsymbol{\mathrm{A}}_{i}$ is a
top-form that is invariant under the gauge transformation

$\boldsymbol{\mathrm{A}}_{i}\to\boldsymbol{\mathrm{A}}_{i}+\mathrm{d}\boldsymbol{\lambda}_{i}.$
(6)

Equipped with the auxiliary field pairs, a given action $I$ in (2) can be
modified to an extended action $\tilde{I}$ as

$\tilde{I}=\int\tilde{\mathbf{L}}\equiv\int\Big{(}\mathbf{L}_{0}-\sum_{i}\alpha_{i}(x)(\mathbf{L}_{i}-\boldsymbol{\mathrm{F}}_{i})\Big{)}.$
(7)

This action is symmetric under the gauge transformation (6) since
$\boldsymbol{\mathrm{F}}_{i}$ is gauge invariant by construction. Besides, it
reproduces the dynamics of the fields in the original action (2) on-shell. To
this end, we denote the collection of the fields
$\\{\Phi,\alpha,\boldsymbol{\mathrm{A}}_{i}\\}$ by $\tilde{\Phi}$. Then, the
variation of (7) followed by the standard integration by parts gives

$\delta\tilde{\mathbf{L}}={\boldsymbol{\mathrm{E}}}^{\tilde{\Phi}}\delta\tilde{\Phi}+\mathrm{d}\tilde{\boldsymbol{\Theta}},$
(8)

in which the modified variations read as

$\displaystyle{\boldsymbol{\mathrm{E}}}^{\tilde{\Phi}}\delta\tilde{\Phi}=\boldsymbol{\mathrm{E}}^{\Phi}_{0}\
\delta\Phi-\sum_{i}$
$\displaystyle\left[\Big{(}\alpha_{i}(x)\boldsymbol{\mathrm{E}}^{\Phi}_{i}-\mathrm{d}\alpha_{i}(x)\frac{\partial\mathbf{L}_{i}}{\partial(\mathrm{d}\Phi)}\Big{)}\delta\Phi+(\mathbf{L}_{i}-\boldsymbol{\mathrm{F}}_{i})\delta\alpha_{i}(x)+\mathrm{d}\alpha_{i}(x)\delta\boldsymbol{\mathrm{A}}_{i}\right],$
(9)
$\displaystyle\quad\tilde{\boldsymbol{\Theta}}=\boldsymbol{\Theta}_{0}-\sum_{i}\alpha_{i}(x)\boldsymbol{\Theta}_{i}+\sum_{i}\alpha_{i}(x)\delta\boldsymbol{\mathrm{A}}_{i}.$
(10)

For clarity, the $x$-dependency of the scalar fields $\alpha_{i}$ is shown
explicitly. In order to find the field equations by the action principle
$\delta\tilde{\mathbf{L}}=0$, the coefficients of $\delta\Phi$,
$\delta\alpha_{i}(x)$, and $\delta\boldsymbol{\mathrm{A}}_{i}$ in (8) should
vanish independently. The equations that arise from the lat two terms yield
the on-shell relations

$\boldsymbol{\mathrm{F}}_{i}=\mathbf{L}_{i},\qquad\mathrm{d}\alpha_{i}(x)=0,$
(11)

respectively. The last equality above implies

$\alpha_{i}(x)=\text{const.},$ (12)

which means that $\alpha_{i}$’s are some _free solution parameters_ that are
constant over space-time. Inserting this crucial result in the overall
coefficient of $\delta\Phi$ in (8) the original equations of motion in (5) are
recovered.

The argument above shows that, as far as the dynamics of the fields $\Phi$ are
concerned, one can use the Lagrangian $\mathbf{L}$ and $\tilde{\mathbf{L}}$
interchangeably. However, the main advantage of $\tilde{\mathbf{L}}$ is to
promote the coupling constants $\alpha_{i}$’s in $\mathbf{L}$ to be free
parameters of the solutions $\tilde{\Phi}$. This vantage point of view is
important for the rest of this paper, where we need the variations of
$\alpha_{i}$’s as solution parameters to be considered in the first law of
black hole thermodynamics. Interestingly, one can go further and show that not
only $\alpha_{i}$’s can be considered as free parameters in the solutions, but
there are also conserved charges which we discuss next.

##  3 Coupling constants as conserved charges

Motivated by the analysis in [29, 30] where the cosmological constant was re-
interpreted as a conserved charge, this section is devoted to showing that in
a theory that is described by the action $I$ in (2) or equivalently by
$\tilde{I}$ in (7), the coupling constants or the solution parameters
$\alpha_{i}$ in (12) are conserved charges associated with the global  part of
the gauge symmetries in (6). For this purpose, the “covariant phase space”
formulation of charges, also known as the Iyer-Wald formulation [31, 32, 33,
34] (initiated and followed in [35, 36, 37, 38]) is apt. The formalism is
reviewed, e.g., in [39, 40, 41]) and applied to various theories (e.g., see
[42]).

Let us first focus on the action $I$ in (2). In the covariant phase space
method, the symplectic current $\boldsymbol{\omega}$ is defined by taking an
exterior derivative of $\boldsymbol{\Theta}$ on the field configuration space,
i.e.,

$\boldsymbol{\omega}(\delta_{1}\Phi,\delta_{2}\Phi,\Phi)=\delta_{1}\mathbf{\Theta}(\delta_{2}\Phi,\Phi)-\delta_{2}\mathbf{\Theta}(\delta_{1}\Phi,\Phi)\,.$
(13)

If the fields $\Phi$ and their variations $\delta\Phi$ satisfy the field
equations and their linearized versions respectively, then the symplectic
current is locally conserved, i.e., $\mathrm{d}\boldsymbol{\omega}=0$. As a
result, it is possible to define the symplectic 2-form

$\Omega(\delta_{1}\Phi,\delta_{2}\Phi,\Phi)\equiv\int_{\Sigma}\boldsymbol{\omega}(\delta_{1}\Phi,\delta_{2}\Phi,\Phi)\,,$
(14)

which makes the field configuration space a phase space. The hypersurface
$\Sigma$ is a Cauchy surface, and the result in (14) is independent of its
choice by the conservation of $\boldsymbol{\omega}$ and the appropriate
boundary conditions.

Having the symplectic form in hand, one can associate a charge variation
$\delta H_{\epsilon}$ to a symmetry generator
$\epsilon\equiv\\{\xi^{\mu},\lambda\\}$ that is composed of a diffeomorphism
$x^{\mu}\to x^{\mu}-\xi^{\mu}$ and some Maxwell (or Yang-Mills) gauge
transformation $A_{\mu}\to A_{\mu}+\partial_{\mu}\lambda$. The charge
variations is defined as $\delta
H_{\epsilon}\equiv\delta_{\epsilon}\Phi\cdot\Omega$, which yields

$\displaystyle\delta H_{\epsilon}(\Phi)$
$\displaystyle=\int_{\Sigma}\big{(}\delta\mathbf{\Theta}(\delta_{\epsilon}\Phi,\Phi)-\delta_{\epsilon}\mathbf{\Theta}(\delta\Phi,\Phi)\big{)}=\int_{\Sigma}\big{(}\delta\mathbf{\Theta}(\delta_{\epsilon}\Phi,\Phi)-\mathcal{L}_{\xi}\mathbf{\Theta}(\delta\Phi,\Phi)\big{)},$
(15)

where in the last equation the gauge invariance of $\boldsymbol{\Theta}$ is
used. By the Cartan identity,
$\mathcal{L}_{\xi}\mathbf{\Theta}=\xi\cdot\mathrm{d}\mathbf{\Theta}+\mathrm{d}(\xi\cdot\mathbf{\Theta})$,
and the on-shell relation $\mathrm{d}\mathbf{\Theta}=\delta\mathbf{L}$ the
charge variation in (15) is equal to

$\displaystyle\int_{\Sigma}\Big{(}\delta(\mathbf{\Theta}(\delta_{\epsilon}\Phi,\Phi)-\xi\cdot\mathbf{L})-\mathrm{d}\big{(}\xi\cdot\mathbf{\Theta}(\delta\Phi,\Phi)\big{)}\Big{)}=\int_{\Sigma}\mathrm{d}\big{(}\delta\mathbf{Q}_{\epsilon}(\Phi)-\xi\cdot\mathbf{\Theta}(\delta\Phi,\Phi)\big{)}.$
(16)

The last equality follows from the celebrated Noether current

$\mathbf{J}_{\epsilon}=\mathbf{\Theta}(\delta_{\epsilon}\Phi,\Phi)-\xi\cdot\mathbf{L}(\Phi),\qquad\mathrm{d}\mathbf{J}_{\epsilon}=0\quad\Rightarrow\quad\mathbf{J}_{\epsilon}=\mathrm{d}\mathbf{Q}_{\epsilon},$
(17)

in which the Poincaré lemma is used to introduce $\mathbf{Q}$ as the Noether
charge density, and $\delta\mathrm{d}=\mathrm{d}\delta$ was also used. By the
Stokes’ theorem, the last term in (16) can be written as a surface integral

$\displaystyle\delta
H_{\epsilon}=\oint_{\partial\Sigma}\boldsymbol{k}_{\epsilon}\,,\qquad\qquad\boldsymbol{k}_{\epsilon}(\delta\Phi,\Phi)\equiv\delta\mathbf{Q}_{\epsilon}(\Phi)-\xi\cdot\mathbf{\Theta}(\delta\Phi,\Phi)\,.$
(18)

Notice that similar to the field equations and $\boldsymbol{\Theta}$ in (5),
$\boldsymbol{k}$ is also linear in the Lagrangian components of arbitrary
action, e.g., for the action $I$ in (2)

$\boldsymbol{k}=\boldsymbol{k}_{0}-\sum_{i}\alpha_{i}\boldsymbol{k}_{i}.$ (19)

Now, we are ready to follow these steps verbatim, this time for the action
$\tilde{I}$ in (7). Considering the additional gauge symmetry in (6), the
charge generator $\epsilon$ is extended to capture this feature, namely

$\tilde{\epsilon}\equiv\\{\xi^{\mu},\lambda,\\{\boldsymbol{\lambda}_{i}\\}\\}$
(20)

for $i$ number of gauge generators $\\{\boldsymbol{\lambda}_{i}\\}$. Then,
replacing $\mathbf{L}\to\tilde{\mathbf{L}}$ and
$\boldsymbol{\Theta}\to\tilde{\boldsymbol{\Theta}}$ in (17) and (18) with
multiple usage of the on-shell condition (12) we find

$\delta
H_{\tilde{\epsilon}}=\oint_{\partial\Sigma}\boldsymbol{k}_{\tilde{\epsilon}}\,,\qquad\qquad\tilde{\boldsymbol{k}}_{\tilde{\epsilon}}=\boldsymbol{k}_{\epsilon}+\sum_{i}\big{(}\xi\cdot\mathbf{A}_{i}\delta\alpha_{i}+\delta(\alpha_{i}\boldsymbol{\lambda}_{i})\big{)}.$
(21)

This relation can be used to calculate the charges of the diffeomorphism and
gauge symmetries, and we will use it to find mass, angular momentum, entropy,
and other black hole charges in the last section. However, here we focus on a
very specific symmetry that is a global part of the gauge transformation (6).
The generator that we choose is proportional to
$\\{0,0,\\{\boldsymbol{\lambda}_{i}\\}\\}$ with only one non-zero gauge
generator, calling it $\boldsymbol{\lambda}_{j}$, that satisfies
$\mathrm{d}{\boldsymbol{\lambda}}_{j}=0$. The rest of gauge generators in
$\\{\boldsymbol{\lambda}_{i}\\}$, i.e., all $\boldsymbol{\lambda}_{i}$ for
$i\neq j$ vanish. To fix the normalization of the generator, we can divide it
by the factor
$|\boldsymbol{\lambda}_{j}|\equiv\oint_{\partial\Sigma}\boldsymbol{\lambda}_{j}$
which is a constant, i.e., independent of the arbitrarily chosen
$\partial\Sigma$ as well as the $x^{\mu}$ (explained below). So, we define

$\hat{\boldsymbol{\lambda}}_{j}=\frac{\boldsymbol{\lambda}_{j}}{|\boldsymbol{\lambda}_{j}|},\qquad\tilde{\epsilon}_{j}\equiv\\{0,0,\hat{\boldsymbol{\lambda}}_{j}\\}.$
(22)

For such generators that are solely composed of the gauge transformations (6),
the only relevant part of the charge variation is the last term in (21). So,

$\delta
H_{\tilde{\epsilon}_{j}}=\oint_{\partial\Sigma}\delta(\alpha_{j}\hat{\boldsymbol{\lambda}}_{j})=\delta\alpha_{j},$
(23)

where the last equation is a result of the on-shell $x^{\mu}$-independency of
$\alpha_{i}$, $\delta\hat{\boldsymbol{\lambda}}_{j}=0$, and the normalization
convention in (22). This result is one of the main achievements of this paper,
because it shows that the coupling $\alpha_{j}$ is the conserved charge
$H_{\tilde{\epsilon}_{j}}$,

$H_{\tilde{\epsilon}_{j}}=\alpha_{j}.$ (24)

In order to complete the argument, we clarify why
$\oint_{\partial\Sigma}\boldsymbol{\lambda}_{j}$ is a constant if
$\mathrm{d}\boldsymbol{\lambda}_{j}=0$. By the last term in (21), the charge
variation $\delta H$ for the generator $\boldsymbol{\lambda}_{j}$ is
proportional to this surface integral. However, the transformation is an exact
symmetry, i.e., $\delta_{\boldsymbol{\lambda}_{j}}\tilde{\Phi}=0$ whose
symplectic current $\boldsymbol{\omega}$ vanishes. This feature makes the
charges not only to be conserved, i.e., independent of some time coordinate,
but also independent of the choice of the $\partial\Sigma$. The remaining
$D-2$ coordinates that parameterize $\partial\Sigma$ are integrated out. So,
no space-time and $\partial\Sigma$-dependency remain.

##  4 Conjugate chemical potentials for the coupling constants

The electric charge in Maxwell’s electrodynamics is the charge of the global
part of the $U(1)$ gauge symmetry $A\to A+\mathrm{d}\lambda$ with
$\mathrm{d}\lambda=0$. For a black hole, its conjugate chemical potential is
the electric potential, i.e.,
$\mathit{\Phi}_{{}_{\mathrm{H}}}\equiv\xi_{{}_{\mathrm{H}}}\cdot A$ calculated
on the event horizon, in which $\xi_{{}_{\mathrm{H}}}$ is the horizon
generating Killing vector field. Motivated by this potential, for the action
$\tilde{I}$ in (7) which has the gauge fields $\mathbf{A}_{i}$ with associated
conserved charges $\alpha_{i}$, we can define their conjugate chemical
potentials on the event horizon as

$\mathit{\Psi}^{i}_{{}_{\mathrm{H}}}\equiv\oint_{\mathrm{H}}\xi_{{}_{\mathrm{H}}}\cdot\mathbf{A}_{i}.$
(25)

Such a definition of chemical potential for a coupling constant was first
introduced in the context of upgrading the cosmological constant to be
conserved charge in [29]. It has been proven that it reproduces the conjugate
thermodynamic volume and has been examined for various examples [30]. In the
next section, we use the coupling constants as conserved charges (23) and
their conjugates (25) to extend the first law of black hole thermodynamics.

##  5 Extension of the first law of black hole thermodynamics

Let us consider a stationary black hole in the coordinates where the horizon
generating Killing vector is given as
$\xi_{{}_{\mathrm{H}}}=\partial_{t}+\mathit{\Omega}^{n}\partial_{\varphi^{n}}$
in which $n$ runs over the the axial isometries, and $\mathit{\Omega}^{n}$ are
corresponding horizon angular velocities. In [32, 33], Iyer and Wald showed
that entropy for non-extremal black holes is a conserved charge of this vector
normalized by the Hawking temperature
$T_{{}_{\mathrm{H}}}=\frac{\kappa_{{}_{\mathrm{H}}}}{2\pi}$ [9], where
$\kappa_{{}_{\mathrm{H}}}$ is the surface gravity of the Killing horizon H.
Later in [43, 44], an infinite number of horizon Killing vectors whose charges
are the entropy of extremal black holes were found in their near-horizon
region. However, in the presence of electromagnetic gauge fields,
integrability shows that the proposed Killing vectors (both for extremal and
non-extremal) have missed a contribution from the gauge fields. In [45, 46] it
was shown that in order to have integrable and gauge-, as well as,
diffeomorphism-invariant conserved charges, their vector field generator
should be augmented by some gauge transformations (the reader is invited to
read [47, 48, 49, 50] for reviews and applications). Here, we focus on the
action $\tilde{I}$ in (7) that, in addition to some probable Maxwell field
$A_{\mu}\mathrm{d}x^{\mu}$, it also has the auxiliary gauge fields
$\mathbf{A}_{i}$. Then, in appropriately chosen gauges, the generator of the
integrable entropy is

$\displaystyle\tilde{\epsilon}_{{}_{S}}=\frac{2\pi}{\kappa_{{}_{\mathrm{H}}}}\\{\xi_{{}_{\mathrm{H}}},-\mathit{\Phi}_{{}_{\mathrm{H}}},\\{-\mathit{\Psi}^{i}_{{}_{\mathrm{H}}}\hat{\boldsymbol{\lambda}}_{i}\\}\\}.$
(26)

Let us denote the symplectic symmetry generators of the mass $M$, angular
momenta $J_{n}$, and electric charge $Q$ by
$\tilde{\epsilon}_{{}_{M}}=\\{\partial_{t},0,\\{0\\}\\}$,
$\tilde{\epsilon}_{{}_{J_{n}}}=\\{-\partial_{\varphi^{n}},0,\\{0\\}\\}$ and
$\eta_{{}_{Q}}=\\{0,1,\\{0\\}\\}$, respectively. They are assumed to be “
_exact_ ” symmetries, i.e., they satisfy
$\delta_{\tilde{\epsilon}}\tilde{\Phi}=0$. Then, (26) reads

$\displaystyle\frac{\kappa_{{}_{\mathrm{H}}}}{2\pi}\tilde{\epsilon}_{{}_{S}}=\tilde{\epsilon}_{{}_{M}}-\mathit{\Omega}^{n}_{{}_{\mathrm{H}}}\tilde{\epsilon}_{{}_{J_{n}}}-\mathit{\Phi}_{{}_{\mathrm{H}}}\tilde{\epsilon}_{{}_{Q}}-\sum_{i}\mathit{\Psi}^{i}_{{}_{\mathrm{H}}}\tilde{\epsilon}_{i},$
(27)

where definition of $\tilde{\epsilon}_{i}$ in (22) was also used. However, by
the linearity of charge variations
${\delta}H_{a\tilde{\epsilon}_{1}+b\tilde{\epsilon}_{2}}=a{\delta}H_{\tilde{\epsilon}_{1}}+b\,{\delta}H_{\tilde{\epsilon}_{2}}$
in (21), the first law of black hole thermodynamics is derived as

$T_{{}_{\mathrm{H}}}\delta S=\delta
M-\mathit{\Omega}^{n}_{{}_{\mathrm{H}}}\delta
J_{n}-\mathit{\Phi}_{{}_{\mathrm{H}}}\delta
Q-\sum_{i}\mathit{\Psi}^{i}_{{}_{\mathrm{H}}}\delta\alpha_{i}.$ (28)

This method of proving the first law was first introduced in [45], where the
non-extended version of (28) was derived directly from the local identity
(27), i.e., without addressing the surfaces of integration on the horizon and
at infinity (which is used in the Iyer-Wald proof of the first law). It works
because the generators in (27) are all “ _exact_ ” symmetries, and as a
result, their charge variations in (21) are independent of the surface of
integration [51].

By dimensional analysis and scaling argument, the Smarr formula can be deduced
from the first law (see, e.g., [52, 19]). The same analysis for the extended
first law yields

$(D-3)M=(D-2)T_{{}_{\text{H}}}S+(D-2)\Omega^{n}_{{}_{\text{H}}}J_{n}+(D-3)\mathit{\Phi}_{{}_{\text{H}}}Q+k^{(i)}\mathit{\Psi}^{i}_{{}_{\text{H}}}\alpha_{i}.$
(29)

Details of the derivation can be found in Section 6 of Ref. [30]. The factor
$k^{(i)}$ is the scaling of the $\alpha_{i}$, i.e., if the length $l$ is
scaled by a factor $z$ as $l\to z\times l$, then $\alpha_{i}\to
z^{k^{(i)}}\times\alpha_{i}$.

##  6 Example: Thermodynamics of the rotating BTZ black hole in the New
Massive Gravity

In [30] some black hole solutions were studied of which the Smarr formula was
not satisfied if the contribution of the couplings was not included. Here, we
provide one of these as an example: that is the rotating BTZ black hole
solution of the NMG theory [53] in the coordinates $x^{\mu}=(t,r,\varphi)$
[55, 54]

$\mathcal{L}=\frac{1}{16\pi}\left(R-2\Lambda-\beta\left(\frac{3}{8}R^{2}-R_{\mu\nu}R^{\mu\nu}\right)\right).$
(30)

The metric is given as

$\displaystyle\mathrm{d}s^{2}=-\Delta\mathrm{d}t^{2}+\frac{\mathrm{d}r^{2}}{\Delta}+r^{2}(\mathrm{d}\varphi-\omega\mathrm{d}t)^{2},\qquad\Delta\equiv-m+\frac{r^{2}}{\ell^{2}}+\frac{j^{2}}{4r^{2}},\qquad\omega\equiv\frac{j}{2r^{2}},$
(31)

for $\Lambda=\frac{-1}{\ell^{2}}+\frac{\beta}{4\ell^{4}}$, $\Lambda<0$ and
$\beta>0$. The black hole outer and inner horizons are at the radii $r_{+}$
and $r_{-}$ which satisfy
$2r_{\pm}^{2}=\ell^{2}(m\pm\sqrt{m^{2}-{j^{2}}/{\ell^{2}}})$ where $m$ and $j$
are free parameters of the solution. The thermodynamic properties of this
solution are [54, 56]

$\displaystyle M=(1+\frac{\beta}{2\ell^{2}})\frac{m}{8},\qquad
J=(1+\frac{\beta}{2\ell^{2}})\frac{j}{8},$
$\displaystyle\Omega_{\pm}=\frac{r_{\mp}}{\ell r_{\pm}},\qquad
T_{\pm}=\frac{r_{\pm}^{2}-r_{\mp}^{2}}{2\pi\ell^{2}r_{\pm}},\qquad
S_{\pm}=(1+\frac{\beta}{2\ell^{2}})\frac{\pi r_{\pm}}{2},$ (32)

with the Horizon Killing vectors
$\xi_{\pm}=\partial_{t}+\Omega_{\pm}\partial_{\varphi}$. The mass and angular
momentum follow from the general construction of conserved charges in higher
derivative theories of gravity [57, 58].

It is easy to check that the quantities in (6) do not satisfy the Smarr
formula if the last term in (29) is omitted. Examples such as this led us to
the current attempt to rescue the Smarr formula. To remedy this issue, we can
apply the procedure described above. The couplings $\Lambda$ and $\beta$ are
promoted to the scalars $\Lambda(x)$ and $\beta(x)$, and their paired field
strengths ${F}_{\\!{}_{\Lambda}}(x)$ and ${F}_{\\!{}_{\beta}}(x)$ (which are
related to $\mathbf{F}_{\\!{}_{\Lambda}}(x)$ and
$\mathbf{F}_{\\!{}_{\beta}}(x)$ in (7) by a Hodge dual transformation) are
implemented in the Lagrangian (30)

$\tilde{\mathcal{L}}=\frac{1}{16\pi}\left(R-2\Lambda(x)\Big{(}1-{F}_{\\!{}_{\Lambda}}(x)\Big{)}-\beta(x)\Big{(}\frac{3}{8}R^{2}-R_{\mu\nu}R^{\mu\nu}-{F}_{\\!{}_{\beta}}(x)\Big{)}\right).$
(33)

It is clear that there is a conventional normalization in defining the
couplings, e.g., instead of the $\Lambda$ one can consider
$\frac{\Lambda}{8\pi}$ as the coupling. Nonetheless, as is expected, such a
convention does not affect the physical thermodynamic laws because these
factors are compensated in the conjugate potentials.

By variation of the Lagrangian with respect to the new pairs of fields,
equations of motion in (11) are derived that imply the following on-shell
relations:

${F}_{\\!{}_{\Lambda}}(x)=1,\qquad{F}_{\\!{}_{\beta}}(x)=\frac{3}{8}R^{2}-R_{\mu\nu}R^{\mu\nu},\quad$
(34)

as well as the constancy of the $\Lambda$ and $\beta$. Therefore,

$\displaystyle\mathbf{F}_{\\!{}_{\Lambda}}(x)=\boldsymbol{\epsilon}=\sqrt{-g}\,\,\mathrm{d}t\wedge\mathrm{d}r\wedge\mathrm{d}\varphi=r\,\,\mathrm{d}t\wedge\mathrm{d}r\wedge\mathrm{d}\varphi,$
(35)
$\displaystyle\mathbf{F}_{\\!{}_{\beta}}(x)=\Big{(}\frac{3}{8}R^{2}-R_{\mu\nu}R^{\mu\nu}\Big{)}\boldsymbol{\epsilon}=\frac{3r}{2\ell^{4}}\,\,\mathrm{d}t\wedge\mathrm{d}r\wedge\mathrm{d}\varphi.$
(36)

The gauge fields whose field strengths are calculated above are

$\displaystyle\mathbf{A}_{{}_{\Lambda}}(x)=-\Big{(}\frac{r^{2}}{2}-\frac{\beta
m\ell^{2}}{2\beta-4\ell^{2}}\Big{)}\mathrm{d}t\wedge\mathrm{d}\varphi,$ (37)
$\displaystyle\mathbf{A}_{{}_{\beta}}(x)=-\Big{(}\frac{3r^{2}}{4\ell^{4}}-\frac{m(\beta-4\ell^{2})}{4\ell^{2}(\beta-2\ell^{2})}\Big{)}\mathrm{d}t\wedge\mathrm{d}\varphi.$
(38)

Notice that the second term in each one of the parentheses is a pure gauge,
which can be fixed by different methods, e.g., we have requested that the
integrability of the black hole charges be respected by the new contribution
of $\xi\cdot\mathbf{A}_{i}\delta\alpha_{i}$ in (21)
($\boldsymbol{k}_{\epsilon}$ can be found in [30, 48]). Now, we can insert the
gauge fields into (25) to find the chemical potentials,

$\mathit{\Psi}^{\Lambda}_{\pm}=-\pi\Big{(}{r_{\pm}^{2}}-\frac{\beta
m\ell^{2}}{\beta-2\ell^{2}}\Big{)},\qquad\mathit{\Psi}^{\beta}_{\pm}=-\pi\Big{(}\frac{3r^{2}_{\pm}}{2\ell^{4}}-\frac{m(\beta-4\ell^{2})}{2\ell^{2}(\beta-2\ell^{2})}\Big{)}.$
(39)

One can check that the first law and the Smarr formula are satisfied for each
one of the horizons as

$\displaystyle\delta M=T_{\pm}\delta S_{\pm}+\mathit{\Omega}_{\pm}\delta
J+\mathit{\Psi}^{\Lambda}_{\pm}\delta(\frac{\Lambda}{8\pi})+\mathit{\Psi}^{\beta}_{\pm}\delta(\frac{\beta}{16\pi}),$
(40) $\displaystyle
0=T_{\pm}S_{\pm}+\mathit{\Omega}_{\pm}J-2\mathit{\Psi}^{\Lambda}_{\pm}(\frac{\Lambda}{8\pi})+2\mathit{\Psi}^{\beta}_{\pm}(\frac{\beta}{16\pi}),$
(41)

respectively. The numerical factors $\frac{1}{8\pi}$ and $\frac{1}{16\pi}$ in
the coupling charges are conventional, and come from how $\alpha_{i}$ and
$\mathcal{L}_{i}$ are defined from the combination $\alpha_{i}\mathcal{L}_{i}$
in the Lagrangian (33). However, independent of this convention, the relation

$\mathit{\Psi}^{\Lambda}_{\pm}\delta(\frac{\Lambda}{8\pi})=V_{\pm}\delta P$
(42)

reproduces the volume-pressure term in black hole chemistry in which $V$ is
the “thermodynamic volume” introduced in [19] (note the conventional minus
signs that cancel each other in $V$ and $P$). This result is not accidental,
and proof of it can be found in Section 2 of the Ref.[30].

##  7 Conclusions

When various dimensionful couplings enter a theory of gravity that has matter
fields, cosmological constant, and higher derivative terms, the first casualty
of black hole thermodynamics are the first law and the beautiful Smarr formula
expressing the relation between the variations of conserved charges and their
total values, respectively. These two laws are simply not valid anymore for
black holes in such a generic theory of gravity. One has two options: accept
that the Smarr formula and the first law of thermodynamics are an accident of
Einstein’s gravity, or try to rescue these by upgrading the coupling constants
of the theory to be conserved charges of the corresponding solution. But this
requires a crucial step: first, the coupling constants are assumed to be
space-time-dependent fields which are set to be constants as a consequence of
the field equations. This can be done by the introduction of auxiliary abelian
gauge fields as described in this work. The vantage point presented here, that
is enlarging the theory by considering the coupling constants as space-time
fields that take constant values as a result of the field equations, saves the
first law of black hole mechanics and the Smarr formula. We have given a
detailed account of this above and applied the new formalism to the rotating
BTZ black hole in the New Massive Gravity (a quadratic theory much studied in
the last decade).

Acknowledgements: KH is thankful to Jutta Kunz for her supports, and members
of the HEP group at IPM for the useful discussions in the weekly meetings.
This work has been supported by TÜBITAK International Researchers Program No.
2221.

## References

  * [1]
  * [2] A. Einstein, “Kosmologische Betrachtungen zur allgemeinen Relativitätstheorie,” Sitzungsberichte der Königlich Preußischen Akademie der Wissenschaften (Berlin), Seite 142-152, (1917).
  * [3] S. Perlmutter et al. [Supernova Cosmology Project Collaboration], “Measurements of Omega and Lambda from 42 high redshift supernovae,” Astrophys. J. 517, 565 (1999), [arXiv:astro-ph/9812133].
  * [4] A. G. Riess et al. [Supernova Search Team], “Observational evidence from supernovae for an accelerating universe and a cosmological constant,” Astron. J. 116, 1009 (1998), [arXiv:astro-ph/9805201].
  * [5] J. M. Maldacena, “The Large N limit of superconformal field theories and supergravity,” Int. J. Theor. Phys. 38, 1113 (1999) [Adv. Theor. Math. Phys. 2, 231 (1998)] [arXiv:hep-th/9711200].
  * [6] J. D. Brown and M. Henneaux, “Central Charges in the Canonical Realization of Asymptotic Symmetries: An Example from Three-Dimensional Gravity,” Commun. Math. Phys. 104, 207 (1986).
  * [7] James M. Bardeen, B. Carter, and S.W. Hawking, “The Four laws of black hole mechanics”, Commun.Math.Phys., 31, 161–170, (1973).
  * [8] Jacob D. Bekenstein, “Black holes and entropy”, Phys. Rev. D, 7, 2333–2346, (1973).
  * [9] S.W. Hawking, “Particle Creation by Black Holes”, Commun.Math.Phys., 43, 199–220, (1975).
  * [10] M. Henneaux and C. Teitelboim, “The Cosmological Constant As A Canonical Variable,” Phys. Lett. 143B, 415 (1984).
  * [11] M. Henneaux and C. Teitelboim, “The Cosmological Constant and General Covariance,” Phys. Lett. B 222, 195 (1989).
  * [12] C. Teitelboim, “The Cosmological Constant As A Thermodynamic Black Hole Parameter,” Phys. Lett. 158B, 293 (1985).
  * [13] M. M. Caldarelli, G. Cognola and D. Klemm, “Thermodynamics of Kerr-Newman-AdS black holes and conformal field theories,” Class. Quant. Grav. 17, 399 (2000) [arXiv:hep-th/9908022].
  * [14] Y. Sekiwa, “Thermodynamics of de Sitter black holes: Thermal cosmological constant,” Phys. Rev. D 73, 084009 (2006) [arXiv:hep-th/0602269].
  * [15] M. Cvetic, G. W. Gibbons, D. Kubiznak and C. N. Pope, “Black Hole Enthalpy and an Entropy Inequality for the Thermodynamic Volume,” Phys. Rev. D 84, 024037 (2011) [arXiv:1012.2888].
  * [16] B. P. Dolan, “The cosmological constant and the black hole equation of state,” Class. Quant. Grav. 28, 125020 (2011) [arXiv:1008.5023].
  * [17] B. P. Dolan, “Pressure and volume in the first law of black hole thermodynamics,” Class. Quant. Grav. 28, 235017 (2011) [arXiv:1106.6260].
  * [18] D. Kubiznak, R. Mann, M. Teo, “Black hole chemistry: thermodynamics with Lambda”, Class.Quant.Grav. 34 (2017) no.6, 063001, [arXiv:1608.06147].
  * [19] D. Kastor, S. Ray and J. Traschen, “Enthalpy and the Mechanics of AdS Black Holes,” Class. Quant. Grav. 26, 195011 (2009) [arXiv:0904.2765].
  * [20] J. Couch, W. Fischler, P. Nguyen, “Noether charge, black hole volume, and complexity”, JHEP 1703 (2017) 119, [arXiv:1610.02038].
  * [21] S. Hyun, J. Jeong, S. A. Park and S. H. Yi, “Thermodynamic Volume and the Extended Smarr Relation,” JHEP 1704, 048 (2017) [arXiv:1702.06629].
  * [22] P. Meessen, D. Mitsios and T. Ortín, “Black hole chemistry, the cosmological constant and the embedding tensor,” JHEP 12 (2022), 155,  [arXiv:2203.13588].
  * [23] Y. Xiao, Y. Tian and Y. X. Liu, “Extended black hole thermodynamics from extended Iyer-Wald formalism,” [arXiv:2308.12630].
  * [24] L. Smarr, “Mass formula for Kerr black holes,” Phys. Rev. Lett. 30, 71-73, (1973).
  * [25] A. Aurilia, H. Nicolai and P. K. Townsend, “Hidden Constants: The Theta Parameter of QCD and the Cosmological Constant of N=8 Supergravity,” Nucl. Phys. B 176, 509 (1980).
  * [26] M. J. Duff and P. van Nieuwenhuizen, “Quantum Inequivalence of Different Field Representations,” Phys. Lett. 94B, 179 (1980).
  * [27] S. W. Hawking, “The Cosmological Constant Is Probably Zero,” Phys. Lett. 134B, 403 (1984).
  * [28] R. Bousso and J. Polchinski, “Quantization of four form fluxes and dynamical neutralization of the cosmological constant,” JHEP 0006, 006 (2000) [arXiv:hep-th/0004134].
  * [29] D. Chernyavsky and K. Hajian, “Cosmological constant is a conserved charge,” Class. Quant. Grav. 35, no. 12, 125012 (2018) [arXiv:1710.07904].
  * [30] K. Hajian, H. Özsahin and B. Tekin, “First law of black hole thermodynamics and Smarr formula with a cosmological constant,” Phys. Rev. D 104 (2021) no.4, 044024, [arXiv:2103.10983].
  * [31] J. Lee and R. M. Wald, “Local symmetries and constraints”, J. Math. Phys., 31, 725–743, (1990).
  * [32] R. M. Wald, “Black hole entropy is the Noether charge”, Phys. Rev. D, 48, 3427–3431, (1993), [arXiv:gr-qc/9307038].
  * [33] V. Iyer and R. M. Wald, “Some properties of Noether charge and a proposal for dynamical black hole entropy”, Phys. Rev. D, 50, 846–864, (1994), [arXiv:gr-qc/9403028].
  * [34] R. M. Wald and A. Zoupas, “A General definition of ’conserved quantities’ in general relativity and other theories of gravity”, Phys. Rev. D, 61, 084027, (2000), [arXiv:gr-qc/9911095].
  * [35] A. Ashtekar, L. Bombelli, and R. Koul, “Phase space formulation of general relativity without a 3+1 splitting”, Lect. Notes Phys., 278, 356–359, (1987).
  * [36] A. Ashtekar, L. Bombelli, and O. Reula, “The covariant phase space of asymptotically flat gravitational fields”, In M. Francaviglia (ed.), Mechanics, Analysis and Geometry: 200 Years after Lagrange, 417-450, (1990).
  * [37] C. Crnkovic and E. Witten, “Covariant Description Of Canonical Formalism In Geometrical Theories”, In Hawking, S.W. (ed.), Israel, W. (ed.): Three hundred years of gravitation, 676-684, (1987).
  * [38] G. Barnich and F. Brandt, “Covariant theory of asymptotic symmetries, conservation laws and central charges”, Nucl. Phys. B, 633, 3–82, (2002), [arXiv:hep-th/0111246].
  * [39] K. Hajian, “On Thermodynamics and Phase Space of Near Horizon Extremal Geometries”, Ph.D thesis, (2015), [arXiv:1508.03494].
  * [40] A. Seraj, “Conserved charges, surface degrees of freedom, and black hole entropy”, Ph.D thesis, (2016), [arXiv:1603.02442].
  * [41] A. Corichi, I. Rubalcava-Garcia, and T. Vukasinac, “Actions, topological terms and boundaries in first-order gravity: A review”, Int. J. Mod. Phys. D, 25, 041630011, (2016), [arXiv:1604.07764].
  * [42] C. Nazaroglu, Y. Nutku and B. Tekin, “Covariant Symplectic Structure and Conserved Charges of Topologically Massive Gravity,” Phys. Rev. D 83, 124039 (2011), [arXiv:1104.3404]
  * [43] K. Hajian, A. Seraj and M. M. Sheikh-Jabbari, “NHEG Mechanics: Laws of Near Horizon Extremal Geometry (Thermo)Dynamics,” JHEP 1403, 014 (2014), [arXiv:1310.3727].
  * [44] K. Hajian, A. Seraj and M. M. Sheikh-Jabbari, “Near Horizon Extremal Geometry Perturbations: Dynamical Field Perturbations vs. Parametric Variations,” JHEP 10 (2014), 111 [arXiv:1407.1992].
  * [45] K. Hajian and M. M. Sheikh-Jabbari, “Solution Phase Space and Conserved Charges: A General Formulation for Charges Associated with Exact Symmetries,” Phys. Rev. D 93, no. 4, 044074 (2016) [arXiv:1512.05584].
  * [46] K. Hajian, M. M. Sheikh-Jabbari and B. Tekin, “Gauge invariant derivation of zeroth and first laws of black hole thermodynamics,” Phys. Rev. D 106 (2022) no.10, 104030,  [arXiv:2209.00563].
  * [47] K. Hajian, “Conserved charges and first law of thermodynamics for Kerr-de Sitter black holes,” Gen. Rel. Grav. 48, no. 8, 114 (2016) [arXiv:1602.05575].
  * [48] M. Ghodrati, K. Hajian and M. R. Setare, “Revisiting Conserved Charges in Higher Curvature Gravitational Theories,” Eur. Phys. J. C 76, no. 12, 701 (2016) [arXiv:1606.04353].
  * [49] K. Hajian and M. M. Sheikh-Jabbari, “Redundant and Physical Black Hole Parameters: Is there an independent physical dilaton charge?,” Phys. Lett. B 768, 228 (2017) [arXiv:1612.09279].
  * [50] K. Hajian, M. M. Sheikh-Jabbari and H. Yavartanoo, “Fluffing Extreme Kerr,” [arXiv:1708.06378].
  * [51] G. Barnich, “Boundary charges in gauge theories: Using Stokes theorem in the bulk”, Class. Quant. Grav., 20, 3685–3698, (2003), [arXiv:hep-th/0301039].
  * [52] P. K. Townsend, “Black holes: Lecture notes,” [arXiv:gr-qc/9707012].
  * [53] E. A. Bergshoeff, O. Hohm and P. K. Townsend, “Massive Gravity in Three Dimensions,” Phys. Rev. Lett., 102, 201301, (2009), [arXiv:0901.1766].
  * [54] G. Clement, “Warped AdS(3) black holes in new massive gravity,” Class. Quant. Grav. 26 (2009), 105015 [arXiv:0902.4634].
  * [55] M. Banados, C. Teitelboim and J. Zanelli, “The Black hole in three-dimensional space-time,” Phys. Rev. Lett., 69, 1849, (1992), [arXiv:hep-th/9204099].
  * [56] G. Alkac and D. O. Devecioglu, “Covariant Symplectic Structure and Conserved Charges of New Massive Gravity,” Phys. Rev. D 85 (2012), 064048 [arXiv:1202.1905].
  * [57] S. Deser and B. Tekin, “Energy in generic higher curvature gravity theories,” Phys. Rev. D 67, 084009 (2003), [arXiv:hep-th/0212292].
  * [58] S. Deser and B. Tekin, “Gravitational energy in quadratic curvature gravities,” Phys. Rev. Lett. 89, 101101 (2002), [arXiv:hep-th/0205318].


# Generating Phishing Attacks using ChatGPT

Sayak Saha Roy, Krishna Vamsi Naragam, Shirin Nilizadeh
The University of Texas at Arlington
{sayak.saharoy<EMAIL_ADDRESS><EMAIL_ADDRESS>
### Abstract

ChatGPT’s ability to generate human-like responses and understand context has
made it a popular tool for conversational agents, content creation, data
analysis, and research and innovation. However, its effectiveness and ease of
accessibility makes it a prime target for generating malicious content, such
as phishing attacks, that can put users at risk. In this work, we identify
several malicious prompts that can be provided to ChatGPT to generate
functional phishing websites. Through an iterative approach, we find that
these phishing websites can be made to imitate popular brands and emulate
several evasive tactics that have been known to avoid detection by anti-
phishing entities. These attacks can be generated using vanilla ChatGPT
without the need of any prior adversarial exploits (jailbreaking).

##  1 Introduction

ChatGPT is an advanced language model developed by OpenAI, aimed at
facilitating natural language interactions with users. Utilizing an extensive
training dataset comprised of books, articles, and websites, ChatGPT is
capable of generating human-like responses across a diverse range of inquiries
and topics. This powerful AI tool has experienced significant growth,
attracting more than 100 million users in under three months. Noteworthy
applications of ChatGPT include: Creating well-crafted content for marketing
and advertising campaigns [62], supporting software development by authoring
and troubleshooting code [26], and developing resources for digital learning
[51, 11], among other use cases.

While ChatGPT offers numerous benefits, its ease of generating content has
inadvertently attracted malicious actors aiming to create social engineering
scams on a large scale. It is worth mentioning that ChatGPT is designed to
detect and refuse prompts intended to produce fraudulent, misleading, or
malicious content, in accordance with OpenAI’s usage policy [38, 46]. However,
adversaries have successfully crafted prompts that evade this detection
mechanism, resulting in the generation of harmful content such as malicious
emails [30, 24, 31], investment and dating scams [66], and computer malware
[58, 17]. Presently, there are several active discussions in underground
online forums centered around leveraging ChatGPT for more sophisticated
security attacks [8].

In this work, we identify how phishing attacks, especially the ones which
escape detection by security tools, can be generated using ChatGPT. Phishing
websites, after being hosted on a web domain are widely shared through several
online communication resources, such as emails, SMS, social media, etc., and
also indexed by search engines. Since these attacks can cause a lot of harm
within a short duration [43], threat intelligence actors, such as anti-
phishing bots utilize various automated rule-based [53, 9, 55] and ML-based
approaches [23, 34, 36] to identify phishing websites. On the other hand,
attackers introduce various perturbations to the website structure, or exploit
weaknesses in the web-browser to evade detection [44, 74]. While several of
these evasive approaches have been studied in literature [43, 3, 36, 61],
anti-phishing tools are sometimes unable to effectively detect these attacks
[43, 37], leading to wide-scale phishing campaigns from time to time. However,
creating these attacks can be time consuming and require technical expertise
[68, 6].

Given the challenges in crafting evasive phishing attacks, the primary goal of
our work is to investigate the feasibility of utilizing ChatGPT for generating
phishing attacks that have been known to bypass contemporary anti-phishing
detection mechanisms. We discuss our method to create prompts that can deceive
ChatGPT into creating source code for both regular and eightevasive phishing
attacks that impersonate 50 popular brands and organizations that are targeted
the most by attackers [15].

###  1.1 Threat Model

An attacker provides multiple prompts to ChatGPT with the intention of
generating the source code for a phishing website that: a) closely imitates
the design of a popular organization’s website, b) employs various regular and
evasive tactics to deceive users into sharing their sensitive information, and
c) incorporates mechanisms for transmitting the obtained credentials back to
the attacker. These prompts are specifically designed to bypass ChatGPT’s
content filtering measures, making it difficult to detect the malicious
intent. Once the attacker receives the generated source code, they proceed to
host it on a domain, creating a live phishing website that poses a significant
risk to unsuspecting users. Generating phishing attacks using ChatGPT provides
the attacker with the following advantages:

  * •

Rapid Deployment Attackers take advantage of the low cost and ease of use of
ChatGPT to quickly iterate on their phishing attacks, making it more difficult
for security vendors to identify and counter them at scale.

  * •

Technical Expertise Variability: The ease of use of ChatGPT allows attackers
with varying levels of technical expertise to generate phishing attacks which
employ varioys evasive techniques that can avoid anti-phishing detection, such
as text encoding, browser fingerprinting, or clickjacking.

  * •

Hosting and Accessibility: Attackers can utilize free hosting platforms to
deploy their phishing websites, further lowering the barriers to entry and
making large-scale attacks more feasible.

###  1.2 Ethical Considerations

This work acts as a proof of concept to demonstrate the feasibility of
generating evasive phishing attacks using ChatGPT. Since we are in the process
of disclosing our set of prompts (used to design these attacks) to OpenAI, we
cannot publicly share them in this iteration of the paper. However, we
describe our methodology for generating these prompts to encourage the
development of more generalized approaches to detecting and mitigating the
possibility of such attacks in ChatGPT and other LLMs.

##  2 Methodology

Figure 1: Breaking down the prompt into functional objects to trick ChatGPT
into generating the attack

(a)

(b)

Figure 2: Example of two simple prompts which asks ChatGPT to create a
phishing attack both directly (a) and indirectly (b). In both cases, ChatGPT
refuses both requests, citing violation of OpenAI TOS. Our goal to engineer
prompts that can evade this refusal and lead to functional phishing attacks.

ChatGPT is able to generate code in several programming languages, which can
be utilized by developers to build functional software from scratch with no
human coding effort [21, 25]. Similarly, ChatGPT can be used to construct
websites from scratch by generating HTML, CSS, JS and PHP source code, which
can be then utilized for phishing purposes. In this paper, our first goal is
to create prompts that could be used to generate regular phishing websites
with credential-stealing intentions. To have a practical impact, the generated
code should be able to create a one-to-one imitation of the websites of
popular brands and organizations. We provide our prompts to ChatGPT using
their recently released API [45] (which uses the _gpt-3.5-turbo_ model) and
then evaluate the generated website source code. Asking the model directly to
generate a phishing attack or any language indicating malicious intention
results in ChatGPT marking the prompt as “unethical” and violating OpenAI’s
Terms of use [47] as illustrated in Figure 2. However, in this work, we show
that an attacker can easily bypass this detection model and create prompts to
specifically instruct the model to create seemingly benign functional objects
which can _collectively_ be used in the attack without hinting at their
intention. Figure 1 illustrates an example of generating a phishing website
targeting Facebook and using an evasive exploit.

###  2.1 Constructing the attacks

As illustrated in Figure 2, ChatGPT refuses to comply when directly asked to
generate a phishing attack due to its built-in abuse detection model. Our goal
is to show how an attacker can modify prompts so that they do not explicitly
indicate malicious intentions while still allowing ChatGPT to generate
functional components that can be assembled to create phishing attacks. Our
prompts have four primary functional components:

Design object: Firstly, ChatGPT is asked to create a design that was inspired
by a targeted organization (instead of imitating it). ChatGPT can create
design style sheets that are very similar to the target website, often using
external design frameworks to add additional functionality (such as making the
site responsive [4] using frameworks such as Bootstrap [13] and Foundation
[19]). Website layout assets such as icons and images are also automatically
linked from external resources.
Credential-stealing object: Emulation of the website design can be followed by
generating relevant credential-taking objects such as input fields, login
buttons, input forms, etc.
Exploit generation object: We then ask ChatGPT to implement a functionality
based on the evasive exploit. For example, for a Text encoding exploit
(Section 3.8), the prompt asks to encode all readable website code in ASCII.
For a reCAPTCHA code exploit 3.2, our prompt asks to create a multi-stage
attack, where the first page contains the QR Code, which leads to the second
page, which contains credential-taking objects.
Credential transfer object: Finally, we ask ChatGPT to create a function that
can send the credentials entered on the phishing websites to the attacker.
ChatGPT generates essentials JS functions or PHP scripts that can send the
credentials using email, send it to an attacker-owned remote server, or store
it in a back-end database.

These functional instructions can be written as a sequence of prompts, one
after the other. Using this method, we show that an attacker is able to
successfully generate both regular and evasive phishing attacks that target 50
popular organizations, including Facebook, DHL, Microsoft, Amazon, Chase,
PayPal, etc. It is important to note that while ChatGPT can generate the
entire source code of the attacks with little to no intervention (after the
attacker provides the initial prompt), the attacker still needs to host the
attack on a web domain. We discuss our approach towards hosting these attacks
in Section 4.

##  3 Generation of phishing websites

This section introduces various evasive phishing attacks and examines how
ChatGPT can be used to generate them. These attacks range from both client-
side and server-side attacks and those obfuscating content from the
perspective of users as well as automated anti-phishing crawlers. The
motivation behind implementing these attacks is to cover a diverse range of
phishing attacks that have been detected and studied in the literature. By
investigating the capability of ChatGPT to generate these types of attacks, we
aim to demonstrate its potential impact on the security landscape and raise
awareness among security researchers and practitioners. In addition to
generating regular phishing attacks [5, 6, 69, 44], the evasive attacks
implemented in this study are: Captcha [28, 29] and QR code [73, 7, 57] based
multi-stage attacks, Broswer in the Browser attacks [40], Clickjacking attacks
[72, 54], attacks utilizing various evasive DOM features [35], Polymorphic URL
attacks [16, 32] and Text encoding attacks [63].

###  3.1 Regular phishing attack

Phishing attacks that incorporate login fields directly within the websites to
steal users’ credentials. In this type of attack, the fraudulent website link
appears to come from a reputable source and includes a seemingly genuine login
form embedded within the email itself. Unsuspecting users may enter their
credentials directly into the website, believing it to be a legitimate request
for authentication. Once the user submits their information, the attacker
captures the login credentials and can use them for unauthorized access to the
victim’s accounts, identity theft, or other malicious activities. These
websites are the most basic family of phishing attacks which do not have any
evasive property. Using ChatGPT, these attacks can be easily constructed by
designing the layout of the website, and incorporating both credential
stealing objects and credential transfer objects.

###  3.2 ReCAPTCHA attacks

ReCAPTCHA is a security measure designed by Google [49, 12, 42] to prevent
automated bots from accessing or using a website’s services. It requires users
to complete a task, such as selecting images that match a certain description,
to prove that they are human. However, this feature is also exploited by
attackers as an evasive measure for creating phishing attacks as it is
difficult for automated anti-phishing bots to evaluate such websites. The
attacker may present a fake login page that includes a reCAPTCHA challenge and
the victim is asked to complete the challenge to gain access to their account.
Once the victim completes the reCAPTCHA challenge, their credentials are
captured by the attacker, who can then use them to gain unauthorized access to
the victim’s account. We specifically attempted to exploit reCAPTCHA v2 which
is widely used by websites [18]. ChatGPT was able to generate a fully
functional attack consisting of a benign webpage with a reCAPTCHA audio/image
challenge, solving which would lead to a malicious login page. The attacker
only needs to provide the secret key which can be obtained from Google Cloud
[22].

###  3.3 QR Code attacks

Figure 3: Intial landing page generated by ChatGPT which contains a QR code
created automatically using QRServer API. Scanning the QR code leads to a
different Amazon phishing page (Also designed by ChatGPT).

QR codes are 2D barcodes that can be scanned via a smartphone or similar
device, and they are widely utilized to hold data such as website links,
contact information, or payment details. In a phishing scheme involving QR
codes, an attacker can share a website containing a QR code, which when
scanned by the victim, leads to a different URL that contains a phishing
website [39, 27, 71]. In this case, the initial landing page is a (benign) QR
code, with no indication of the malicious URL in a readable text format, and
thus cannot be evaluated by an anti-phishing crawler. ChatGPT was able to
generate this attack, with the option of either the attacker providing the QR
code image (as an external file), or generating it itself. In the second case,
ChatGPT automatically used the QRServer API [52] to generate the image. Figure
3 illustrates one such attack generated by ChatGPT.

###  3.4 Browser-in-the-Browser attack

First identified by security researcher mr.d0x in 2022 [41], a Browser-in-the-
Browser attack (BITB) is a phishing tactic aimed at individuals who use single
sign-on (SSO) for the convenience of accessing various interlinked
applications or websites. In this form of attack, cybercriminals generate a
deceptive pop-up that mimics a web browser inside the actual browser and
displays a URL similar to the authentic one. The purpose of this fraudulent
pop-up is to obtain sensitive user data, like login details, which can lead to
identity theft. The primary vulnerability exploited by BitB attacks is the
users’ difficulty in differentiating between a genuine domain and a
counterfeit one when confronted with a pop-up window. Consequently, companies
providing SSO options across multiple applications face a heightened risk of
having their clients’ sensitive data jeopardized through browser-based
attacks. Using ChatGPT we were able to generate this attack by generating
browser windows that emulated the design of MacOS as illustrated in Figure 4.

Figure 4: An example of a Browser in the Browser attack generated by ChatGPT.
Here clicking on the ’Login with Amazon’ button leads to the rogue popup
imitating the design and URL of the real Amazon login page.

###  3.5 iFrame injection/Clickjacking

Figure 5: Example of a clickjacking attack generated by ChatGPT which leads to
an Amazon phishing page

The iFrame is an HTML tag that allows web developers to embed one webpage
within another. Attackers use this feature to load a malicious website inside
a legitimate one. These attacks are usually carried out in two ways: i) The
iFrame is visible, and looks like it is part of the original website [64], ii)
The iFrame is hidden behind a legitimate object (such as a ’Submit’ button)
and the user is encouraged to interact with that button, wherein reality they
are interacting with the hidden i-Frame. This technique is also known as
clickjacking [10]. While generating this attack, ChatGPT was also able to
ensure that the iFrame object adhered to the same origin policy [50] as to not
trigger anti XSS (Cross Site Scripting) implementations in prevalent web
browsers. Figure 5 illustrates one such attack generated using ChatGPT which
imitates an iPhone giveaway scam which has an hidden iFrame linking to a
Amazon phishing page (Also generated by ChatGPT).

###  3.6 Exploiting DOM classifiers

Attackers can create phishing websites which are designed to avoid detection
by a specific anti-phishing classifier. Liang et al. [35] identified and
exploited several features of a website’s Document Object Model (DOM), which
are evaluated by Google phishing pages filter (GPPF), the client-side anti-
phishing tool included with Google Chrome. A website’s DOM is tree-like
structure of objects created by a web browser when an HTML document is loaded,
allowing programming languages like JavaScript to interact with and manipulate
its elements. Liang et al. [35] found that modifying the parameters of these
objects in a website can significantly reduce its chances of being detected by
GPPF. ChatGPT was able to create a phishing login page with all the modified
parameters, which included changing input type attributes, removing relevant
script elements, linking to target domains, sourcing external resources (such
as images) from the root of the website, among many others.

###  3.7 Polymorphic URL

_Polymorphic phishing_ attacks are designed such that a new URL is generated
every time the website is accessed, making it hard for anti-phishing block-
lists to evaluate and keep track of them. To accomplish this, attackers use
PHP scripts executed on the server-side, that append a random string at the
end of the URL each time there is a request to access the website [16, 32].
Upon appending this functionality to the template of our regular imitation
attack (Section 2), ChatGPT was able to generate both the necessary client
side HTML and server side PHP to emulate this attack.

###  3.8 Text encoding exploit

(a)

(b)

Figure 6: Generating a text encoding exploit using ChatGPT

Attackers encode the text of the credential taking intention fields with ASCII
or Morse code characters codes such that they are not recognizable from the
website’s source code [70, 20]. However, this code upon being rendered by a
web browser, displays the text as intended. We were able to generate this by
providing specific instructions on which fields to obfuscate in a way that it
would be hard for text detection algorithms to detect. Figure 3.8 shows an
example of ChatGPT generating a phishing website where the ’User-ID’ and
’Password’ fields are obfuscated in the source code. Figure 6 illustrates one
such attack created by ChatGPT.

###  3.9 Browser fingerprinting attacks

Figure 7: Snippet of Server-side script generated by ChatGPT to evade crawling
by Google Safe Browsing

A Browser Fingerprinting attack is designed such that the phishing attack is
only shown to the user if they visit the website through a specific “agent,”
i.e., web-browsers, mobile devices, or specific IP ranges [33, 67]. Visiting
such websites using other agents results in a benign or blank page being
rendered. Such attacks are often used to evade anti-phishing bots which visit
new websites to identify malicious features. Browser fingerprinting phishing
attacks are becoming increasingly common and sophisticated, and can be
difficult to detect and prevent. We were able to create prompts which could
generate phishing pages which are rendered only when visited through a certain
desktop web browser such as Google Chrome, or when it was accessed through a
mobile device. Similarly we were able to restrict access to agents coming from
certain IP ranges. Attackers can easily provide IP ranges belong to anti-
phishing crawlers this way. Figure 7 illustrates one such attack created by
ChatGPT which can evade crawling by Google Safe Browsing [1].

##  4 Iterative prompts and hosting the phishing attacks

Attacks | Iterations
---|---
Coder 1 | Coder 2 | Coder 3
Design & Credential transfer | 11 | 8 | 10
Regular | +0 | +0 | +0
Captcha phishing | +3 | +2 | +2
QR Code phishing | +2 | +1 | +3
Browser fingerprinting | +1 | +1 | +2
DOM Features | +3 | +3 | +4
Clickjacking | +5 | +3 | +4
Browser-in-the-Browser | +5‘ | +5 | 7
Punycode | +1 | +1 | +3
Polymorphic URLs | +1 | +2 | +4

Table 1: Iterations required by our three coders to generate the phishing
attacks using ChatGPT which imitate the Amazon brand. The first row signifies
the number of iterations required to create the base design and transfer the
credentials back to the attacker which is the same for all attacks, with the
remaining rows signifying the number of iterations required on top of it to
create the respective exploit.

We examined the number of iterative prompts required by three independent
coders (graduate students in Computer Science) to create each phishing attack
discussed from Sections 3.1 through 3.9. These coders possessed varying levels
of technical proficiency in Computer Security: Coder 1 specialized in the
field, Coder 2 had some familiarity through academic coursework, and Coder 3
had no prior exposure. Table 1 presents our findings. Each coder created their
own set of prompts for designing the website layout and for transmitting the
stolen credentials back to the attacker, which they reused for multiple
attacks. Our analysis reveals that all coders, regardless of their expertise
in Computer Security, demonstrated similar performance when generating exploit
prompts. This observation may suggest that crafting phishing attacks using
ChatGPT does not necessitate extensive security knowledge, although it is
important to note that all coders were technically proficient. To further
assess the ease with which ChatGPT can be used to generate phishing websites,
it would be intriguing to expand this study to include participants who lack
technical proficiency. This could provide a more comprehensive understanding
of the potential risks associated with using ChatGPT for malicious purposes.

We also deployed each attack on a free web hosting platform (000webhost [2])
to evaluate the effectiveness of phishing website scripts produced through
ChatGPT. The initial step involved incorporating the ChatGPT-generated scripts
into their corresponding file formats (.html, .css, .js, etc.), followed by
integrating these scripts into the default WordPress template supplied by the
hosting service. To prevent unintended user access, we did not promote or
sharing these websites in any way. Furthermore, we ensured that any data input
into these sites was discarded, though no such instances were observed.
Finally, we removed the websites soon after hosting them, again so that they
cannot be accidentally accessed. Given their affordability, cybercriminals
frequently leverage free hosting domains to execute large-scale phishing
attacks [14]. Utilizing ChatGPT-generated source code streamlines this
process, further reducing the effort and technical expertise needed for
successful deployment.

##  5 Discussion

Our work shows that ChatGPT can be used to generate both regular and evasive
phishing attacks. While we focus on eight such attacks which are known to
evade evaluation by anti-phishing entities, our approach can easily be
extrapolated to other evasive attack categories. We discuss ramifications for
the phishing ecosystem and limitations below:

Attacker opportunity: Firstly, the process of generating and hosting phishing
websites can be massively expedited using the ChatGPT API. As illustrated in
Table 1, very few prompts are required to generate the attacks, and the low
API usage cost [48] combined with the presence of free hosting domains [56],
makes the entire process very easy and cost-effective for the attacker. On the
other hand, security vendors have, over time, designed extensive heuristic
approaches to detect automated phishing kits. Presently, scrutiny of malicious
content generated by Large Language Models such as ChatGPT is still at a
nascent stage [59], thus making it more convenient for attackers to abuse this
resource to release new attacks at a rapid pace.

Missing resources: We found that in some of the cases, external images
included in the generated website might be outdated since the training cut-off
date for ChatGPT was in October 2021 [65]. A follow-up prompt to replace these
objects usually solved the problem. It can be assumed that attackers can also
manually replace these resources whenever required or use ChatGPT
implementations that have access to real-time internet resources such as
AutoGPT [60] or Bing Chat [60].

## References

  * [1] Google Safebrowsing.  https://safebrowsing.google.com/, 2020.
  * [2] 000webhost.  Free Web Hosting with PHP, MySQL and cPanel, No Ads.  https://www.000webhost.com/.  Accessed on April 28, 2023.
  * [3] Acharya, B., and Vadrevu, P. $\\{$PhishPrint$\\}$: Evading phishing detection crawlers by prior profiling.  In 30th USENIX Security Symposium (USENIX Security 21) (2021), pp. 3775–3792.
  * [4] Adobe.  Responsive web design.  https://xd.adobe.com/ideas/principles/web-design/responsive-web-design-2/, July 2021.  [Accessed on 9 March 2023].
  * [5] Alabdan, R. Phishing attacks survey: Types, vectors, and technical approaches.  Future internet 12, 10 (2020), 168.
  * [6] Alkhalil, Z., Hewage, C., Nawaf, L., and Khan, I. Phishing attacks: A recent comprehensive study and a new anatomy.  Frontiers in Computer Science 3 (2021), 563060.
  * [7] Alnajjar, A. Y., Manickam, S., Anbar, M., Al-Saleem, S., and Elejla, O. Trustqr: A new technique for the detection of phishing attacks on qr code.  Advanced Science Letters 22, 10 (2016), 2905–2909.
  * [8] Alper, K., and Cohen, I. Opwnai: Cybercriminals starting to use gpt for impersonation and social engineering.  Check Point Research (March 2023).
  * [9] Álvarez, M., Pan, A., Raposo, J., Bellas, F., and Cacheda, F. Using clustering and edit distance techniques for automatic web data extraction.  In International Conference on Web Information Systems Engineering (2007), Springer, pp. 212–224.
  * [10] Auth0.  Preventing clickjacking attacks, June 2021.
  * [11] Biswas, S. Chatgpt and the future of medical writing, 2023.
  * [12] Blog, S. Dissecting a phishing campaign with a captcha-based url.  Trustwave (March 2021).
  * [13] Bootstrap.  Bootstrap.  https://getbootstrap.com/, 2023.  [Accessed on 9 March 2023].
  * [14] Boulevard, S. Most phishing attacks use compromised domains and free hosting.
  * [15] Cloudflare.  The 50 most impersonated brands and how to protect against phishing, 2021\.
  * [16] Cofense.  Global polymorphic phishing attack 2022.  https://bit.ly/3ZVtu4t, March 2022.  [Accessed: March 9, 2023].
  * [17] Cohen, L. Chatgpt hack allows chatbot to generate malware, June 2021.
  * [18] Developers, G. recaptcha v3: Add the recaptcha script to your html or php file.  https://developers.google.com/recaptcha/docs/display, September 2021\.  [Online; accessed 9-March-2023].
  * [19] Foundation.  Foundation.  https://get.foundation/, 2023.  [Accessed on 9 March 2023].
  * [20] Fouss, B., Ross, D. M., Wollaber, A. B., and Gomez, S. R. Punyvis: A visual analytics approach for identifying homograph phishing attacks.  In 2019 IEEE Symposium on Visualization for Cyber Security (VizSec) (2019), IEEE, pp. 1–10.
  * [21] Gizchina.  First chatgpt-written app hits the app store: Should developers be scared?  https://bit.ly/3HMRf8j, 2023.
  * [22] Google.  Google cloud.  https://cloud.google.com/, 2023.  [Online; accessed 9-March-2023].
  * [23] Gu, X., Wang, H., and Ni, T. An efficient approach to detecting phishing web.  Journal of Computational Information Systems 9, 14 (2013), 5553–5560.
  * [24] Hoffman, C. It’s scary easy to use chatgpt to write phishing emails.  CNET (October 2021).
  * [25] iMore.  Move over wordle, chatgpt just invented a new puzzle game you can play right now.  https://bit.ly/42kgMxO, 2023.
  * [26] Jalil, S., Rafi, S., LaToza, T. D., Moran, K., and Lam, W. Chatgpt and software testing education: Promises & perils.  arXiv preprint arXiv:2302.03287 (2023).
  * [27] Kan, M. Fbi: Hackers are compromising legit qr codes to send you to phishing sites.  PCMag (May 2022).  [Online; accessed 9-March-2023].
  * [28] Kang, L., and Xiang, J. Captcha phishing: A practical attack on human interaction proofing.  In Proceedings of the 5th international conference on Information security and cryptology (2009), pp. 411–425.
  * [29] Kang, L., and Xiang, J. Captcha phishing: a practical attack on human interaction proofing.  In Information Security and Cryptology: 5th International Conference, Inscrypt 2009, Beijing, China, December 12-15, 2009. Revised Selected Papers 5 (2010), Springer, pp. 411–425.
  * [30] Karanjai, R. Targeted phishing campaigns using large scale language models.  arXiv preprint arXiv:2301.00665 (2022).
  * [31] Kovacs, E. Malicious prompt engineering with ChatGPT, September 2021.
  * [32] Lam, I.-F., Xiao, W.-C., Wang, S.-C., and Chen, K.-T. Counteracting phishing page polymorphism: An image layout analysis approach.  In Advances in Information Security and Assurance: Third International Conference and Workshops, ISA 2009, Seoul, Korea, June 25-27, 2009\. Proceedings 3 (2009), Springer, pp. 270–279.
  * [33] Laperdrix, P., Bielova, N., Baudry, B., and Avoine, G. Browser fingerprinting: A survey.  ACM Transactions on the Web (TWEB) 14, 2 (2020), 1–33.
  * [34] Li, Y., Yang, Z., Chen, X., Yuan, H., and Liu, W. A stacking model using url and html features for phishing webpage detection.  Future Generation Computer Systems 94 (2019), 27–39.
  * [35] Liang, B., Su, M., You, W., Shi, W., and Yang, G. Cracking classifiers for evasion: A case study on the google’s phishing pages filter.  In Proceedings of the 25th International Conference on World Wide Web (2016), pp. 345–356.
  * [36] Liu, R., Lin, Y., Yang, X., Ng, S. H., Divakaran, D. M., and Dong, J. S. Inferring phishing intention via webpage appearance and dynamics: A deep vision based approach.  In 30th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 21) (2022).
  * [37] Maroofi, S., Korczyński, M., and Duda, A. Are you human? resilience of phishing detection to evasion techniques based on human verification.  In Proceedings of the ACM Internet Measurement Conference (2020), pp. 78–86.
  * [38] MiniTool.  ChatGPT: This content may violate our content policy, February 2022\.
  * [39] Morgan, M. Qr code phishing scams target users and enterprise organizations.  Security Magazine (October 2021).  [Online; accessed 9-March-2023].
  * [40] mr.d0x.  Browser in the browser (bitb) attack.  https://mrd0x.com/browser-in-the-browser-phishing-attack/.
  * [41] mrd0x.  Browser in the Browser: Phishing Attack.  https://mrd0x.com/browser-in-the-browser-phishing-attack/, January 2022.  Accessed on April 28, 2023.
  * [42] Odeh, A., Keshta, I., and Abdelfattah, E. Machine learningtechniquesfor detection of website phishing: A review for promises and challenges.  In 2021 IEEE 11th Annual Computing and Communication Workshop and Conference (CCWC) (2021), IEEE, pp. 0813–0818.
  * [43] Oest, A., Safaei, Y., Zhang, P., Wardman, B., Tyers, K., Shoshitaishvili, Y., and Doupé, A. Phishtime: Continuous longitudinal measurement of the effectiveness of anti-phishing blacklists.  In 29th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 20) (2020), pp. 379–396.
  * [44] Oest, A., Zhang, P., Wardman, B., Nunes, E., Burgis, J., Zand, A., Thomas, K., Doupé, A., and Ahn, G.-J. Sunrise to sunset: Analyzing the end-to-end life cycle and effectiveness of phishing attacks at scale.  In 29th USENIX Security Symposium (USENIX Security 20) (2020).
  * [45] OpenAI.  Introducing the chatgpt and whisper apis.  https://openai.com/blog/introducing-chatgpt-and-whisper-apis, June 2021.  [Accessed on 9 March 2023].
  * [46] OpenAI.  Openai usage policies, 2021.
  * [47] OpenAI.  Terms of use.  https://openai.com/policies/terms-of-use/, 2021.  Accessed on March 8, 2023.
  * [48] OpenAI.  Openai pricing.  https://openai.com/pricing, 2023.  [Online; accessed 9-March-2023].
  * [49] Palo Alto Networks Unit 42.  Captcha-protected phishing: What you need to know.  https://unit42.paloaltonetworks.com/captcha-protected-phishing/, June 2021\.  [Accessed: March 9, 2023].
  * [50] PortSwigger.  Same-origin policy.  https://portswigger.net/web-security/cors/same-origin-policy, 2023\.  [Online; accessed 9-March-2023].
  * [51] Qadir, J. Engineering education in the era of chatgpt: Promise and pitfalls of generative ai for education.
  * [52] QRCode Monkey.  QR Server.  https://www.qrserver.com/, Accessed on March 8, 2023.
  * [53] Rani, S., and Singh, J. Enhancing levenshtein’s edit distance algorithm for evaluating document similarity.  In International Conference on Computing, Analytics and Networks (2017), Springer, pp. 72–80.
  * [54] Rao, K. S., Jain, N., Limaje, N., Gupta, A., Jain, M., and Menezes, B. Two for the price of one: A combined browser defense against xss and clickjacking.  In 2016 International Conference on Computing, Networking and Communications (ICNC) (2016), IEEE, pp. 1–6.
  * [55] Roopak, S., and Thomas, T. A novel phishing page detection mechanism using html source code comparison and cosine similarity.  In 2014 Fourth International Conference on Advances in Computing and Communications (2014), IEEE, pp. 167–170.
  * [56] Roy, S. S., Karanjit, U., and Nilizadeh, S. A large-scale analysis of phishing websites hosted on free web hosting domains.  arXiv preprint arXiv:2212.02563 (2022).
  * [57] Sharevski, F., Devine, A., Pieroni, E., and Jachim, P. Gone quishing: A field study of phishing with malicious qr codes.  arXiv preprint arXiv:2204.04086 (2022).
  * [58] Shkatov, M. Chatting our way into creating a polymorphic malware, January 2018.
  * [59] Si, W. M., Backes, M., Blackburn, J., De Cristofaro, E., Stringhini, G., Zannettou, S., and Zhang, Y. Why so toxic? measuring and triggering toxic behavior in open-domain chatbots.  In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security (2022), pp. 2659–2673.
  * [60] Significant-Gravitas.  Auto-GPT: Automating GPT Fine-tuning for Everyone.  https://github.com/Significant-Gravitas/Auto-GPT, 2021.
  * [61] Song, F., Lei, Y., Chen, S., Fan, L., and Liu, Y. Advanced evasion attacks and mitigations on practical ml-based phishing website classifiers.  International Journal of Intelligent Systems 36, 9 (2021), 5210–5240.
  * [62] Southern, M. Chatgpt examples: 5 ways businesses are using openai’s language model, 2021.
  * [63] Tandale, K. D., and Pawar, S. N. Different types of phishing attacks and detection techniques: A review.  In 2020 International Conference on Smart Innovations in Design, Environment, Management, Planning and Computing (ICSIDEMPC) (2020), IEEE, pp. 295–299.
  * [64] Team, S. iframe injection attacks and mitigation.  SecNHack (February 2022).  [Online; accessed 9-March-2023].
  * [65] TechCrunch.  Chatgpt shrugged, December 2022.
  * [66] Tucker, T. A consumer-protection agency warns that scammers are using ai to make their schemes more convincing and dangerous.  Business Insider (March 2023).
  * [67] Upathilake, R., Li, Y., and Matrawy, A. A classification of web browser fingerprinting techniques.  In 2015 7th International Conference on New Technologies, Mobility and Security (NTMS) (2015), IEEE, pp. 1–5.
  * [68] US Department of Homeland Security, C., and Agency, I. S. Phishing trends and countermeasures.  Tech. rep., Cybersecurity and Infrastructure Security Agency, May 2011\.
  * [69] Varshney, G., Misra, M., and Atrey, P. K. A survey and classification of web phishing detection schemes.  Security and Communication Networks 9, 18 (2016), 6266–6284.
  * [70] Ventures, C. Beware of lookalike domains in punycode phishing attacks.  Cybersecurity Ventures (2019).
  * [71] Vidas, T., Owusu, E., Wang, S., Zeng, C., Cranor, L. F., and Christin, N. Qrishing: The susceptibility of smartphone users to qr code phishing attacks.  In Financial Cryptography and Data Security: FC 2013 Workshops, USEC and WAHC 2013, Okinawa, Japan, April 1, 2013, Revised Selected Papers 17 (2013), Springer, pp. 52–69.
  * [72] Wu, L., Brandt, B., Du, X., and Ji, B. Analysis of clickjacking attacks and an effective defense scheme for android devices.  In 2016 IEEE Conference on Communications and Network Security (CNS) (2016), IEEE, pp. 55–63.
  * [73] Yong, K. S., Chiew, K. L., and Tan, C. L. A survey of the qr code phishing: the current attacks and countermeasures.  In 2019 7th International Conference on Smart Computing & Communications (ICSCC) (2019), IEEE, pp. 1–5.
  * [74] Zhang, P., Oest, A., Cho, H., Sun, Z., Johnson, R., Wardman, B., Sarker, S., Kapravelos, A., Bao, T., Wang, R., et al. Crawlphish: Large-scale analysis of client-side cloaking techniques in phishing.  In 2021 IEEE Symposium on Security and Privacy (SP) (2021), IEEE, pp. 1109–1124.