Phishing Page’s Evasion Code Backfires and Breaks Its Own Credential-Stealing Attack
Brief
A phishing page designed to evade security tools accidentally broke its own credential-stealing operation after a coding error trapped victims’ browsers in an endless JavaScript loop.
The suspicious message initially appeared ordinary. It used a familiar phishing lure and directed recipients to a web address that included the target’s email address as a parameter.
But when the link was opened in a virtual machine, the browser did not show a login page. Instead, it froze for about 30 seconds while one CPU core reached 100% usage.
The website’s HTML was retrieved almost immediately, ruling out a slow server response. The issue was hidden inside heavily obfuscated JavaScript used to decode and display the phishing kit.
Phishing Evasion Code Backfires
The malicious script used two functions as part of its decoding routine.