The article describes JavaScript obfuscation techniques used in phishing kits, malware loaders, and malicious npm packages. It covers static hiding (string encoding, lookup tables, dynamic property access, dead code), runtime hiding (code generation via eval/Function/setTimeout, control-flow flattening, anti-debugging), and automated obfuscation via tools like javascript-obfuscator. A practical deobfuscation workflow is outlined: beautify, extract strings, identify execution sinks, replace sinks with logging, and capture generated payloads in controlled environments.
phishing-kit
2 posts
JavaScript obfuscation: From party trick to phishing kit Kali365 Targets US Organizations with Data Theft via Device Code Phishing Kali365 is a device code phishing kit targeting US organizations by abusing legitimate Microsoft and Google device authentication flows. Instead of capturing passwords on fake login pages, the kit directs victims to authentic Microsoft/Google device login pages where they enter attacker-provided codes, granting attackers OAuth access and refresh tokens. The phishkit supports 34 lure templates across multiple brands and exposes identifiable API endpoints (/api/generate, /api/lure-config, /api/status) that can be used for detection.
