Phishing pages that rewrite their own code every visit

Published August 25, 2026

Researchers found a phishing page that rewrites its own code every time someone opens it, so the login-stealing form never looks the same twice on the outside. It still does the same job: trick a visitor into typing their username and password into a fake page.

Report priority
Medium

How it works

The phishing link loads a page whose JavaScript has been scrambled by an obfuscation tool that renames variables, reorders functions, and rewrites numbers differently on every single visit, then unscrambles itself in the browser to show a normal-looking credential form.

What to do

If you opened such a link and entered credentials, change that password immediately and turn on multi-factor authentication. Otherwise, treat unexpected sign-in prompts with suspicion and verify them through a source you already trust rather than the link in the message.

Technical details

A phishing message lands in an inbox with a web link. The person opens it, and analysts at the Internet Storm Center noticed the browser froze for about 30 seconds and pushed one processor core to full use. That happened because a coding mistake in the page's own scrambling script trapped a counter in a loop. On the 49 other attempts the script decoded properly and produced a familiar-looking form asking for login details.

The Internet Storm Center found a phishing page using polymorphic JavaScript: each of 50 fetches produced a unique SHA-256 hash, 21 distinct page titles, reordered and renamed functions, and differently computed numeric values. After decoding, the resulting HTML also varied per visit in form and input names, CSS classes, element IDs, image parameters, and hidden zero-width characters, though the final credential form's function stayed constant. One sample failed to decode because two nested loops shared an undeclared variable named k, trapping a counter between 48 and 49; giving the inner loop its own counter fixed it. ISC says this pattern looks like an automated obfuscation tool rather than confirmed real-time AI code generation.

References

View Original Source