Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing Java Script in Real Time

Summary: Unit 42 built a proof of concept in which a benign-looking webpage calls trusted LLM APIs from the browser, using carefully engineered prompts to get malicious JavaScript back and assemble it into a working phishing page at runtime, leaving no static payload on the page. The PoC replicated the LogoKit phishing campaign, and the researchers found simple rephrasing bypassed the model's safeguards - a generic AJAX POST request was permitted while a direct request for credential-exfiltration code was blocked - with each query returning a syntactically unique but functionally identical variant.

Why it matters: Unit 42 reports that 36% of the malicious webpages it detects daily already exhibit runtime assembly behavior, and this technique makes each payload unique per victim and delivered over a trusted LLM domain, so network inspection sees only a clean page.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
AI Security
Related