As the question says, How are hackers able to plant Phishing URLs in existing websites? And can it be detected?
You honestly could have a wide array of possibilities and answers depending on how something would be 'compromised.' When you think about it, if StackExchange wasn't monitoring for active hyperlinks and tracing it to things like reputation sources at virustotal, proofpoint, etc. Then you could easily just comment/post phishing URL's in any public forums for comment. If you're referring to more of a compromise sort of things there's a few things to think about:
- If the site has input capabilities; then vulnerable injection vectors such as persistent XSS can have layered scripts inserted that have phishing links or other click fraud and related malicious objects
- There's also direct compromise-- manipulating the content displayed on the webpage. Common vulnerabilities and exploits exist in CMS's like wordpress.
- There's also possibilities where an advertising network or CDN is compromised and attackers can have phishing related clickable links or ads served (even exploits).
As far as detection, you need active content scraping and analysis possibly including the following protection mechanisms:
- Static pages -- integrity checking
- Have a crawler or bot continuously check the ads or dynamic content served for malicious scripts or URL's
- Have your reverse proxy or WAF detect returned content to the user for possible injected or unauthorized content
- Ensure that whatever combination of LAYERED detection and protection mechanisms you have can deobfuscate basic encodings like Base64, HTML, etc.