Recent developments in phishing attack techniques reveal the increasing role of AI in crafting sophisticated threats designed to evade traditional security measures. These attacks leverage AI models, such as DeepSeek and Gemini, to dynamically generate malicious JavaScript code directly within a victim’s browser. By splitting the malware into fragments via separate AI prompts and assembling them client-side from trusted large language model (LLM) domains, attackers bypass conventional security detection systems.
This approach, known as “last mile reassembly,” significantly reduces the chances of detection by leaving no static payload for security tools to analyze. It further complicates defense as it involves using LLM APIs to produce unique, polymorphic variants of phishing scripts at runtime. With this technique, attackers exploit AI safety guardrails, allowing the generation of malicious code that adapts in real time.
The implications of this innovative method highlight the need for new defense strategies. Traditional email security and secure web gateways offer some level of protection, but the emphasis is shifting towards enhancing user awareness and incorporating runtime behavioral analysis within web browsers. By detecting suspicious scripts during execution, rather than relying solely on network-based detection methods, more robust defense lines can be established against these AI-enhanced phishing threats.
In essence, this advancement in AI-utilized offensive security operations underscores the continual evolution of cyber threats and the necessity for adaptive cybersecurity strategies to maintain pace with emerging technologies.

Collections

AI-powered phishing attacks now use large language models like DeepSeek and Gemini to dynamically generate malicious JavaScript code directly in victims' browsers. This "last mile reassembly" technique splits malware into fragments assembled client-side from trusted LLM domains, creating polymorphic variants that evade traditional security detection. The approach leaves no static payload to analyze and exploits AI safety guardrails. Defense strategies must shift from network-based detection to runtime behavioral analysis in browsers and enhanced user awareness to counter these evolving threats.

Exploring AI-Powered Polymorphic Phishing Attacks Through Runtime JavaScript Assembly