A phishing page designed to evade security tools accidentally broke its own credential-stealing operation after a coding error trapped victims’ browsers in an endless JavaScript loop.
The suspicious message initially appeared ordinary. It used a familiar phishing lure and directed recipients to a web address that included the target’s email address as a parameter.
But when the link was opened in a virtual machine, the browser did not show a login page. Instead, it froze for about 30 seconds while one CPU core reached 100% usage.
The website’s HTML was retrieved almost immediately, ruling out a slow server response. The issue was hidden inside heavily obfuscated JavaScript used to decode and display the phishing kit.
Phishing Evasion Code Backfires
The malicious script used two functions as part of its decoding routine. Both functions relied on a loop counter named k, but neither declared that variable locally.
One function was meant to build a decoding table, with its counter progressing from 0 to 63. During every iteration, it called another helper function that created text characters from ASCII values. That inner helper also used k.
Because k was undeclared, JavaScript treated it as a global variable shared by both functions. The inner routine’s final operation generated the / character, ASCII value 47, and left the shared counter at 48.
When execution returned to the outer function, its own increment changed the value to 49. On the next cycle, the inner function reset it back to 48 again. The outer loop was therefore stuck repeating the same values:
48 → 49 → 48 → 49
As a result, the decoding process never completed, the credential-harvesting page never rendered, and the browser consumed CPU resources until the activity stopped or the page was closed.
Changing the inner function to use a locally declared counter allowed the script to complete. The decoded payload was an otherwise routine phishing form intended to steal user credentials.
The initial failure did not appear to be a single corrupted copy. When the same phishing URL was opened again, it worked normally. However, each request returned different source code.
Function and variable names changed between page loads. Functions appeared in different orders, number values were rewritten as arithmetic expressions, encoded payloads differed, and page titles varied.
The visible phishing form remained mostly identical, but its internal HTML, CSS classes, field names, image parameters, and identifiers changed with every visit.
A test that downloaded the page 50 times found that every sample had a different SHA-256 hash. Analysts identified 21 different page titles, while 49 samples deobfuscated successfully. One sample entered the same endless loop seen in the first visit, sans said.
This shows the site used a polymorphic phishing mechanism that created a fresh malicious-page variant for each request.
Such techniques can weaken static defenses based on hashes, fixed identifiers, or simple text signatures. Zero-width characters in visible strings added another anti-analysis layer.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
