Attackers Can Use LLMs to Generate Phishing Pages in Real Time

Unit 42 demonstrates a proof-of-concept attack where benign webpages request client-side JavaScript from trusted LLM services (e.g., DeepSeek, Google Gemini); attackers use carefully engineered prompts to bypass safety guardrails and return malicious JS snippets that are assembled and executed in the browser to render fully functional phishing pages with no static, detectable payload, creating unique, hard-to-detect variants per victim and posing a significant defense challenge.