Forest Global Training Partners

Cyber Risks · Cisco Talos

Java Script obfuscation: From party trick to phishing kit

Summary: Cisco Talos published an analysis of obfuscated JavaScript, describing how string arrays, encoded URLs, runtime decoders, and eval statements strip context from code found in phishing pages, malware loaders, and compromised sites. The post covers pre-runtime tricks such as string hiding, _0x-prefixed lookup tables, dynamic property access, and dead code, alongside runtime techniques including code generation, control-flow flattening, anti-debugging, and JSFuck, and notes that tools like the npm package javascript-obfuscator and obfuscator[.]io automate these techniques.

Key Takeaway: The npm variant matters most: package scripts can run during install, so preinstall, postinstall, build hooks, and test scripts become hiding places where obfuscated code can reach process.env, npm and GitHub tokens, SSH keys, and CI variables - meaning the question shifts from what cookies a page reads to what secrets the build runner had lying around.

Read the original at Cisco Talos ↗

Topics
Malware
Related