Phishing attacks are getting stealthier. Security analysts recently uncovered a campaign in which each time a user opens a phishing page, its underlying code is altered—though the page still looks identical and behaves the same. This polymorphic trick is designed to rip up standard detection methods like signature matching and static hash scanning.
What researchers found
The discovery came after a phishing email arrived in the inbox of analysts at the Internet Storm Center. Instead of entering a login immediately, visitors to the linked page reported about a 30-second delay during which a single processor core spiked in usage—pointing to heavy client-side processing rather than anything happening on the server. Upon stumbling through obfuscated JavaScript, a credential-stealing form finally loaded, disguised by mangled code. Analysts found it included highly scrambled JS and decoy layers before revealing its true purpose.
Digging deeper, the team revisited the same URL multiple times—50 fetches in all. Every single capture had a different SHA-256 hash. The page titles alone varied in over 20 ways. Beneath those differences, the JS functions shuffled, variables were renamed, calculations reworked, and even numeric constants adjusted. The final HTML was also inconsistent: input fields, CSS class names, page IDs, image parameters, hidden zero-width characters—all shuffled. And yet to a user? Nothing seemed off—they saw what looked like a standard login prompt.
Why it works so well—and when it slips up
This approach—often called polymorphic obfuscation—makes basic defenses like static code signatures or repeated form input names mostly useless because each new visit appears different. That said, it’s not foolproof. In some runs, the code failed to run properly. A coding error involving a shared undeclared variable caused looping issues that prevented the page from decoding correctly in a few instances. Out of some 56 total samples, two failed outright. That’s enough to show flaws in the system but still relatively reliable.
The report doesn’t find evidence that generative AI was behind the variants. Rather, the randomness and consistent structural errors suggest use of an obfuscation tool that randomly renames variables and reorders code—without handling scope properly.
How defenders can adapt
Static signatures and hash values can’t be the only tools anymore. Behavior-based detection becomes critical. Analyzing form submission paths, tracking URL hosting behavior, and monitoring underlying structural patterns (rather than just visible names) are much more reliable. For individuals, verifying unexpected login prompts by manually navigating to known URLs—rather than clicking links—helps avoid getting trapped.
Organizations need to assume compromise rather than believe a password reset always solves a breach. That means revoking active sessions and tokens, auditing access logs, and monitoring identity changes should be baked into incident response plans—especially if phishing has led to session-level access.
Here are indicators of compromise identified in this case:
- Domain: addresses.performs.vu, used to host the polymorphic phishing page.
- URL pattern: addresses.performs.vu/communications.html?good=[something], observed in the attack messages.
This campaign shows that what we thought was invisible might just be under constant transformation. Defenders must keep up with changing threats—or risk getting caught off guard.
From a broader perspective, this development matters because it exposes cracks in tools and processes many companies believed were reliable. As obfuscation becomes more common in phishing, defenders should invest in dynamic analysis, invest in zero-trust verification of sign-ins, and prepare for more sophisticated evasion. What to watch next: whether threat actors apply this approach to broader classes of phishing, and whether detection systems evolve to spot persistent structures beneath surface chaos.
