A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)

This article details a sophisticated phishing page that employs a polymorphic obfuscation technique to evade detection. The page initially presents as broken, causing a 30-second delay and high CPU usage, due to a global variable 'k' being used as a loop counter in a JavaScript function. Despite the initial failure, subsequent attempts to load the page consistently resulted in different, yet functionally equivalent, versions of the phishing page, each with altered HTML elements and JavaScript code. The author investigated this phenomenon, discovering that the page was not permanently broken but rather generated multiple variants, with a small percentage (around 2%) resulting in non-functional pages. The investigation suggests a conventional polymorphic obfuscator, potentially leveraging a simple renaming and reordering mechanism, rather than an LLM-based approach, as the transformations between page versions were systematic and consistent. The article highlights the ongoing evolution of phishing techniques and the challenges they pose to traditional detection methods.