--- title: The Next Frontier of Runtime Assembly Attacks:... description: Security researchers demonstrate a novel attack technique where malicious webpages use LLM APIs to dynamically generate phishing JavaScript at runtime.... canonical: https://daily.dev/posts/the-next-frontier-of-runtime-assembly-attacks-leveraging-llms-to-generate-phishing-javascript-in-re-6x4idbljt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time | daily.dev og:description: Security researchers demonstrate a novel attack technique where malicious webpages use LLM APIs to dynamically generate phishing JavaScript at runtime.... og:url: https://daily.dev/posts/the-next-frontier-of-runtime-assembly-attacks-leveraging-llms-to-generate-phishing-javascript-in-re-6x4idbljt og:image: https://api.daily.dev/og/posts/6x4IdBLjT.png og:image:alt: The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time **[Unit 42](https://daily.dev/sources/unit42)** · 12 min read · 0 upvotes · 0 comments ## Summary Security researchers demonstrate a novel attack technique where malicious webpages use LLM APIs to dynamically generate phishing JavaScript at runtime. Attackers craft prompts that bypass AI safety guardrails, causing LLMs to return malicious code snippets that are assembled and executed in the victim's browser. This creates polymorphic, unique variants for each visit while delivering payloads from trusted LLM domains to evade network detection. The attack builds on existing runtime assembly behaviors but adds AI-generated code diversity. Effective defense requires runtime behavioral analysis within browsers rather than traditional network-based detection. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#llm](https://daily.dev/tags/llm), [#phishing](https://daily.dev/tags/phishing), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/the-next-frontier-of-runtime-assembly-attacks-leveraging-llms-to-generate-phishing-javascript-in-re-6x4idbljt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time","url":"https://daily.dev/posts/the-next-frontier-of-runtime-assembly-attacks-leveraging-llms-to-generate-phishing-javascript-in-re-6x4idbljt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-next-frontier-of-runtime-assembly-attacks-leveraging-llms-to-generate-phishing-javascript-in-re-6x4idbljt"},"datePublished":"2026-01-22T11:12:40.376Z","dateModified":"2026-03-02T23:23:55.683Z","description":"Security researchers demonstrate a novel attack technique where malicious webpages use LLM APIs to dynamically generate phishing JavaScript at runtime....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/596b5bde688481d0b8df31d13d1395e4?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/596b5bde688481d0b8df31d13d1395e4?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Unit 42","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Unit 42","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5b55ca8d2ae04181939041fbc9d78160","url":"https://daily.dev/sources/unit42"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-next-frontier-of-runtime-assembly-attacks-leveraging-llms-to-generate-phishing-javascript-in-re-6x4idbljt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,javascript,llm,phishing,web-security","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Unit 42","item":"https://daily.dev/sources/unit42"},{"@type":"ListItem","position":3,"name":"The Next Frontier of Runtime Assembly Attacks: Leveraging LLMs to Generate Phishing JavaScript in Real Time"}]} ```