Polymorphic Phishing Campaign Uses Unique Pages to Evade Detection

A new phishing operation has been identified that employs server-side polymorphism to create unique credential-harvesting pages for nearly every request. This tactic undermines traditional detection methods that rely on static file hashes and fixed HTML identifiers. The campaign was highlighted after a phishing message was submitted to the SANS Internet Storm Center, which pointed to a URL that initially appeared benign. Upon investigation, it was found that the phishing page utilized heavily obfuscated JavaScript, causing browsers to hang due to a coding flaw. This flaw resulted in high CPU usage without rendering the page. The attack targets users by generating unique pages, making it difficult for security systems to detect and block them effectively. The scope of the impact is currently unclear, but the evolving nature of this phishing technique poses a significant threat to users and organizations alike.

Key Points: • Phishing operation uses server-side polymorphism to generate unique pages. • Traditional detection methods are ineffective against this evolving threat. • A coding flaw in the phishing page causes browsers to hang and consume CPU resources.