Phishing page rebuilds itself uniquely on every visit
A phishing kit rebuilds its fake login page from scratch every time someone opens the link, so no two copies look alike in the code behind them. That makes it much harder for security tools to spot and block using known signatures.
- Report priority
- Medium
- Targets
- SANS Internet Storm Center
How it works
- The phishing link sends a heavily scrambled JavaScript file that decodes itself in the victim's browser and then writes out a credential-stealing form.
- The kit's server regenerates that scrambled code with new random names, structure, and math tricks on every single request, so each visit gets its own unique version of the same fake page.
What to do
If you actually opened a suspicious link like this and were shown a login or credentials page asking for your account details, don't enter your username or password on any page reached through an unexpected link, even if the browser stalls or behaves oddly first. If you already typed in credentials on such a page, change that password immediately and turn on two-factor authentication for the account. There's no software to check a version number for here.
Technical details
Affected software: SANS Internet Storm Center
Someone receives a phishing email with a link to a page addressed to their own email account. They open it and their browser freezes for about 30 seconds while one processor core maxes out, because a coding bug in that particular copy trapped the decoder in a loop. On a working copy, the browser instead finishes decoding and shows a fake login form asking for the person's credentials, with a page title like "Viewer" or "Authenticate" that changes from visit to visit.
The kit ships heavily obfuscated JavaScript that self-decodes client-side rather than serving a static payload. In one captured sample, two functions shared an undeclared loop variable k, making it implicitly global; a helper reset k to 48 after the outer loop (meant to iterate 0-63 to build a Base64 decoding map) had incremented it to 49, trapping execution in a 48-to-49 loop and pegging one CPU core instead of rendering. Across 50-56 requests to the same URL, researchers found unique SHA-256 hashes each time, 21 distinct page titles, and randomized function/variable names, form-field names, HTML IDs, CSS classes, and zero-width-character placement, while the underlying credential-theft form and workflow stayed the same. About 2 of ~56 samples failed to decode at all, showing the generator occasionally breaks its own output.