Forensic Reconstruction of Web-Based Social Media Account Takeover via Credential Phishing
Abstract
Credential phishing against browser-authenticated accounts can produce fragmented digital traces across browser storage, phishing infrastructure, network traffic, and account activity records. This study aims to reconstruct a Discord Web account takeover caused by credential phishing through multi-source forensic correlation. Evidence was obtained from Chrome browser artifacts, phishing server logs, Wireshark network captures, and documentation of attacker-side account activity within a controlled experimental scenario. The forensic analysis recovered 10 of 12 expected artifacts, resulting in an Artifact Recovery Rate (ARR) of 83.3%, while 4 of 6 incident stages were supported by at least two evidence items or source layers, producing an Evidence Corroboration Score (ECS) of 66.7%. The reconstructed timeline covers six stages of the incident, from the delivery of a phishing link to the confirmation of account access. The study introduces ARR and ECS as quantitative measures for evaluating artifact recovery and cross-source evidence corroboration. The findings further demonstrate that browser artifacts alone are insufficient to establish a complete account takeover sequence, and that correlation among browser, server, network, and account activity evidence is necessary to construct a coherent and verifiable forensic timeline. These results provide a practical basis for incident responders and forensic examiners to correlate heterogeneous evidence sources when investigating browser-mediated credential phishing.
Related
- From Zero-Dimensional to Continuous Dualities: A Double-Categorical Account
- The journey of numbers from attention to motor processing: an embodied account of neural response to number magnitudes.
- What Does a Benford Test Actually Test? Marginal Conformity, Sampling Structure, and Forensic Inference
- Artificial Intelligence and Machine Learning in the Transformation of Forensic Accounting: A Systematic Literature Review
- Perceived vertical and eye level as one orientation process: a closed-form account of the Li-Matin combination rules for egocentric space
BibTeX
@article{rivai2026forensic,
title = {{Forensic Reconstruction of Web-Based Social Media Account Takeover via Credential Phishing}},
author = {Zulki Yanto Rivai and Anton Yudhana and Imam Riadi},
journal = {Journal of Information Systems and Informatics},
year = {2026},
month = oct,
doi = {10.63158/journalisi.v8i5.1968},
url = {https://doi.org/10.63158/journalisi.v8i5.1968},
note = {CC BY},
}
RIS
TY - JOUR
TI - Forensic Reconstruction of Web-Based Social Media Account Takeover via Credential Phishing
AU - Zulki Yanto Rivai
AU - Anton Yudhana
AU - Imam Riadi
PY - 2026
DA - 2026/10/24
JO - Journal of Information Systems and Informatics
DO - 10.63158/journalisi.v8i5.1968
UR - https://doi.org/10.63158/journalisi.v8i5.1968
AB - Credential phishing against browser-authenticated accounts can produce fragmented digital traces across browser storage, phishing infrastructure, network traffic, and account activity records. This study aims to reconstruct a Discord Web account takeover caused by credential phishing through multi-source forensic correlation. Evidence was obtained from Chrome browser artifacts, phishing server logs, Wireshark network captures, and documentation of attacker-side account activity within a controlled experimental scenario. The forensic analysis recovered 10 of 12 expected artifacts, resulting in an Artifact Recovery Rate (ARR) of 83.3%, while 4 of 6 incident stages were supported by at least two evidence items or source layers, producing an Evidence Corroboration Score (ECS) of 66.7%. The reconstructed timeline covers six stages of the incident, from the delivery of a phishing link to the confirmation of account access. The study introduces ARR and ECS as quantitative measures for evaluating artifact recovery and cross-source evidence corroboration. The findings further demonstrate that browser artifacts alone are insufficient to establish a complete account takeover sequence, and that correlation among browser, server, network, and account activity evidence is necessary to construct a coherent and verifiable forensic timeline. These results provide a practical basis for incident responders and forensic examiners to correlate heterogeneous evidence sources when investigating browser-mediated credential phishing.
SN - 2656-5935
SN - 2656-4882
ER -