Attackers Use LLMs To Generate Phishing JavaScript

Unit 42 reported on Jan. 22, 2026 that attackers are using LLM services to generate dynamic JavaScript payloads in real time within browsers. The post details a novel runtime-assembly attack where malicious webpages invoke LLMs to craft phishing code on the fly, potentially evading static detection. Security teams should monitor runtime behavior, harden LLM API use, and update detection strategies.