Listen to the episode
TLDR
Researchers at the SANS Internet Storm Center analyzed a phishing email whose link pointed to a credential harvesting page built with heavily obfuscated JavaScript. The page was "polymorphic": each visit produced a slightly different...
How it works
Researchers at the SANS Internet Storm Center analyzed a phishing email whose link pointed to a credential harvesting page built with heavily obfuscated JavaScript. The page was "polymorphic": each visit produced a slightly different...
Red flags
- Unsolicited email whose link contains your own address in the query string ( ?good=you@example.com ) — classic targeted phishing. Page hangs for tens of seconds while a CPU core maxes out — a sign of malicious obfuscated JavaScript, not a normal site. The login page and its assets change on every load, defeating simple blocklists
What to do
- 1Never click login links from unsolicited email
- 2navigate to the service directly. Report suspicious messages to your IT/security team and delete them. Keep browsers an
Source
FAQ
Is Polymorphic phishing page that sometimes breaks itself (SANS ISC analysis) a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Unsolicited email whose link contains your own address in the query string ( ?good=you@example.com ) — classic targeted phishing. Page hangs for tens of seconds while a CPU core maxes out — a sign of malicious obfuscated JavaScript, not a normal site. The login page and its assets change on every load, defeating simple blocklists
What should I do first?
Never click login links from unsolicited email; navigate to the service directly. Report suspicious messages to your IT/security team and delete them. Keep browsers an
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.