Cyber Criminals Are Using LLMs For Phishing Attacks, Here’s How

Cybersecurity: New Phishing Techniques Using Large Language Models

Recent research conducted by Unit 42, the threat intelligence team at Palo Alto Networks, highlights a novel method employed by cybercriminals to execute phishing attacks. This technique leverages large language models (LLMs) to construct phishing pages directly within a victim's browser, eliminating the need for pre-fabricated phishing emails or obvious fake login pages.

Initially, the targeted webpage appears benign. It loads without any visible malicious code or links associated with criminal activities. Once opened in a browser, the page sends a request to a trusted LLM service, which then provides JavaScript code that transforms the page into a phishing site. Attackers write specific prompts to instruct the LLM on the malicious activities to perform. The browser then assembles and executes this code in real-time, tailoring the phishing page to the individual visitor.

This method circumvents traditional security checks that examine webpages prior to loading. Since the phishing code does not exist until execution, security tools dependent on stored patterns have difficulty detecting it. Each webpage visit generates a unique version of the phishing code through the LLM, rendering blocklists and static signatures ineffective. Additionally, the malicious content originates from trusted LLM service domains, often permitted within corporate environments, allowing the browser to receive the code without triggering alerts.

Unit 42 developed a proof of concept using the LogoKit phishing framework. This involved substituting static JavaScript with LLM-generated scripts. The webpage made live requests to a recognized LLM service, which returned code that mimicked branded login pages and transmitted stolen credentials to an external server. The page itself remained devoid of any suspicious elements during network transmission.

The research suggests that the most effective defense involves runtime behavioral analysis within the browser to identify suspicious actions, such as credential capture and data exfiltration. Organizations are also advised to restrict access to unauthorized LLM services to minimize easy delivery channels for attacks. Enhanced safety measures within LLM platforms could further mitigate misuse.

Palo Alto Networks recommends utilizing tools like Advanced URL Filtering and Prisma Browser with Advanced Web Protection to thwart runtime assembly attacks by analyzing behavior rather than scanning for known code.

Based on reporting by techround.co.uk.