The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time

According to Unit 42, the article describes a novel AI-augmented attack where a seemingly benign webpage uses client-side calls to trusted LLM services to generate malicious JavaScript in real time, turning a safe-looking page into a personalised phishing page within seconds. The technique involves polymorphic, runtime-assembled code that is delivered from a trusted LLM domain to bypass network analysis and execute in the victim’s browser during page load.

The PoC demonstrates generating and executing malicious scripts at runtime, with prompts engineered to bypass LLM safeguards and produce functional code for credential harvesting and impersonation of target webpages. The authors note that about 36% of malicious webpages they detect exhibit runtime assembly behaviour, underscoring the difficulty of detection when code is created on the fly.

The piece emphasises defensive measures such as runtime behavioural analysis in the browser and restricting unsanctioned LLM services, published on 22 January 2026.