Polymorphic Phishing Page Exploits JavaScript Bug for CPU-Intensive Hang
A sophisticated phishing campaign is employing polymorphic JavaScript obfuscation that, in some instances, causes browsers to hang with 100% CPU utilization due to a flawed global variable implementation.
Researchers have identified a novel phishing technique that utilizes polymorphic JavaScript obfuscation, a method designed to dynamically alter its code with each execution to evade detection. While such techniques are common in phishing kits, this particular variant exhibited an unusual behavior: it caused browsers to freeze and consume excessive CPU resources.
The issue stemmed from a critical flaw in the JavaScript's obfuscation routine. Specifically, a global loop counter variable, 'k', was used across multiple functions. When one of these functions, responsible for constructing character sets, was called, it inadvertently modified the global 'k' value. This premature incrementing of 'k' prevented the outer decoding loop from completing its intended iterations, effectively trapping the script in an infinite or severely truncated loop.
This bug resulted in a noticeable delay and high CPU load for users who encountered the malformed page. Instead of presenting the expected credential-harvesting form, the browser would become unresponsive for a significant period. The delay was not attributed to server-side issues, as the initial page retrieval was instantaneous, pointing directly to a client-side execution problem within the JavaScript itself.
After the obfuscation layers were stripped away, the underlying page was revealed to be a standard credential-stealing page. Initially, the researchers suspected the flaw was an accidental self-inflicted wound by the phishing page's authors, a common occurrence with complex obfuscation. However, subsequent attempts to access the same URL yielded different results.
Further investigation revealed that the phishing page was indeed polymorphic, generating unique variants with each request. While some variants loaded correctly, others still contained the JavaScript bug, leading to the browser hang. This suggests the flaw might have been intentionally introduced, perhaps as a rudimentary form of anti-analysis or to create a diversion, or it could be an intermittent bug within their polymorphic generation process.
Analysis of multiple page samples confirmed the polymorphic nature. Function names, variable declarations, code structure, and even the final payload varied significantly between requests. Despite these variations, the core functionality remained credential theft. The polymorphic behavior extended to the final HTML output, with different form field names, CSS classes, and element identifiers being generated.
The discovery highlights the evolving sophistication of phishing attacks. While JavaScript obfuscation is a known tactic, the introduction of bugs that cause system instability, whether intentional or accidental, adds another layer of complexity for security analysts. The ability of these pages to dynamically change their code also poses a challenge for signature-based detection methods.
This incident underscores the importance of robust browser sandboxing and resource monitoring to detect and mitigate such attacks. It also emphasizes the need for security researchers to look beyond simple code deobfuscation and analyze the dynamic behavior of malicious scripts, especially when they exhibit unexpected system-level effects.