Analyzing CryptoJS Encrypted Phishing Attempt

ARC Labs analyzed a phishing credential-harvesting campaign that embedded obfuscated HTML/SVG and JavaScript (loaded CryptoJS remotely) to hide a second-stage credential collection page. The payload distributed encrypted data across multiple base64-encoded HTML classes, dynamically decrypted at runtime using a hardcoded passphrase, and was recoverable through code and runtime analysis to reveal the final malicious URL.