New Phishing Trends and Evasion Techniques

Zscaler ThreatLabz documents four active phishing campaigns that target brands like Microsoft, Chase and Dropbox by using multilayer JavaScript obfuscation (JavaScript Obfuscator, eval+/atob, hex-encoding), Base64-embedded images, and hosting on trusted services (storage.googleapis.com, *.web.app) or compromised WordPress sites to bypass analysis; the blog provides deobfuscation examples, PCAP evidence of credential exfiltration and a long list of IoCs observed in the Zscaler cloud.