NovaCookies phishing kit debugger-timing anti-analysis JS

Arnold Chan@slaz

•updated Aug 27, 2026•0•0•4

This rule detects JavaScript code patterns indicative of the NovaCookies phishing kit, which employs timing-based anti-analysis techniques to detect if a web developer console is open. By checking the execution time of code via a 'clock' function and monitoring for a 'debugger' statement, the kit attempts to withhold the phishing lure from researchers.