A recent analysis has revealed a sophisticated phishing operation utilizing server-side polymorphism, which enables the creation of distinct credential-harvesting pages for nearly every request. This innovative method significantly undermines traditional detection systems that rely on file hashes, fixed HTML identifiers, and static JavaScript signatures to identify phishing attempts.
The campaign was exposed after a phishing message was submitted to the SANS Internet Storm Center (ISC). This message directed recipients to a suspicious URL structured as hxxps://addresses[.]performs[.]vu/communications.html?good=[recipient_address]. Initially, the URL appeared to be a typical phishing lure, but it was discovered to host heavily obfuscated JavaScript that exhibited variable behavior across different visits, ultimately revealing a credential-stealing page that altered its underlying source code with every loading.
During the first visit to the website, no phishing form appeared. Instead, the browser faced a significant delay, freezing for roughly 30 seconds while a single CPU core was pushed to full utilization. This unusual behavior indicated that the issue resided on the client side rather than being the result of a slow server response.
On further analysis, it was determined that a logic error existed within the JavaScript decoder. Specifically, two functions utilized the same undeclared loop variable named “k,” causing it to become global instead of remaining local. The outer function was designed to iterate through values ranging from 0 to 63, gradually constructing a decoding map. Each loop iteration triggered a helper function tasked with generating character strings corresponding to a Base64 alphabet.
However, a final helper function reset the global counter to 48. When the outer loop incremented the counter to 49, the inner routine would reset it again, leading to a perpetual 48-49 sequence. This sequence trapped the decoder in an infinite loop, preventing the browser from completing the rendering process while continuously consuming processor resources.
Once the variable-scope collision was rectified, the hidden payload could successfully decode, exposing what appeared to be a conventional credential-stealing form. At first glance, the broken response seemed to be a simple coding oversight. However, subsequent requests proved otherwise; the same URL was later able to load normally, but with each response showcasing a different incarnation of the phishing page.
Researchers noticed that across multiple loads of the page, there was a noticeable variability in observable traits. These ranged from randomized function and variable names to reordered function sequences and numeral representations handled through diverse arithmetic expressions. Additionally, altered encoded JavaScript blocks, which contained the ultimate phishing payload, were routinely generated. Moreover, the page titles fluctuated between benign terms such as “Solution,” “Viewer,” “Credentials,” “Private,” and “Authenticate.”
A testing exercise involving 50 downloads of the same URL yielded 50 unique samples, each exhibiting distinct SHA-256 hashes, with the collection reflecting 21 different page titles. Remarkably, 49 of these samples were successfully deobfuscated, while one fell victim to the previously mentioned infinite loop due to another collision involving randomized variable names.
The intricacies of this polymorphic phishing attack were underscored by the SANS researchers, noting that the polymorphism persisted even after the JavaScript decoding process was complete. Each resulting phishing page employed different form-field names, HTML element IDs, CSS class names, and even image-loading parameters, which deployed zero-width character placements. Despite the significant variations at the source code level, the user-facing forms and the overall credential-theft workflow remained relatively unchanged.
This technique effectively diminishes the effectiveness of conventional indicators; while URLs may still face scrutiny from reputation systems, a detection method reliant solely on a static malicious hash, a specific field identifier, or a fixed JavaScript string can easily falter when each request yields a new syntactically distinct sample.
Past research, including documentation by Zscaler, has highlighted kits that create files and directories with random names and varying HTML attribute values per visit as further complicating the analysis and signature-based detection. However, this latest case presents a poignant demonstration of how aggressive mutation can present operational risks for the attackers themselves. Of the 56 samples collected, two were entirely non-functional, suggesting that the polymorphic generator occasionally fails to produce pages capable of completing their own decoding routine.
While the failure rate does not provide a definitive measure of the campaign’s overall reliability, it does illuminate how such evasive coding strategies can inhibit the success of the attackers in harvesting credentials.
With each request leading to the generation of unique pages, questions have arisen regarding the potential involvement of a Large Language Model (LLM). However, no concrete evidence supports this notion. Instead, the systematic transformations and repeated issues with variable scopes imply a use of traditional polymorphic obfuscators that rename and reorder code without sufficiently accounting for JavaScript’s scope.
Nonetheless, the consideration remains relevant, as Unit 42 has demonstrated the feasibility of webpages calling trustworthy LLM services to dynamically generate malicious JavaScript within the victim’s browser. Should such a model be employed, it could yield syntactically distinct phishing payloads for each visit, further obfuscating detection attempts.
For those on the defense front, the key takeaway from this investigation is the importance of focusing on behavioral and runtime signals. These signals include suspicious destinations for form submissions, browser-side deobfuscation activities, excessive consumption of CPU resources, dynamically generated Document Object Model (DOM) content, and indicators of credential capture attempts. Although polymorphism complicates the detection of static signatures, it does not fundamentally alter the methods by which credentials are ultimately collected and exfiltrated from unsuspecting victims.