Malware Writeup: JS:Trojan:Cryxos.2550

This report analyzes a January 2020 surge of a Cryxos JavaScript Trojan variant that renders obfuscated, URL-encoded phishing pages via document.write(unescape()), prompting victims for mobile numbers and passwords and POSTing those credentials to an attacker-controlled domain (https://dotcodesoultions.com/bb/result.php). The analysis describes the encoding/decoding technique, PHP routines extracting email components for form pre-fill, includes screenshots of the rendered pages, and identifies the malicious endpoint as an indicator.