I've recently acquired a SSL certificate from a certificate authority called GlobalSign nv-sa. The certificate is already in use. What I am curious to know is what happens if I change major parts of the source code of my website. So let's say I implement a pishing form to collect user's usernames and passwords. Will the CA ever check if my lovely website turned into a malicious, sensitive data fishing site? Will they then immediately revoke the certificate?
CA's do not regularly check their customers websites, so they will likely not check if your site has turned malicious. The point of a Certificate is to give the end user comfort that the site they are dealing with is not being intercepted en-route, and - for EV certs - gives some assurances that the people behind the certificate are who they say they are.
If it is brought to their attention that your site is being used for phishing then Globalsign has the right to revoke your certificate. This is buried in section 4.10 of their Global Subscriber Agreement at https://www.globalsign.com/en/repository/GlobalSign_Subscriber_Agreement.pdf (also 4.6 -
In practical terms its unlikely your certificate will be revoked without warning, although they are legally entitled to do so.
The CA didn't check your website before issuing the certificate in the first place: it's their job to check the control of the domain for domain validated DV certificates and the identity of the owner for extended validation EV certificates. It's not their responsibility to validate the contents – nor even that they could given the amount of possible pages and dynamic content. (Not to even mention all the other use cases for certificates than HTTPS.)
Therefore, malicious actors can acquire valid certificates, too. Such occasions might get addressed retrospectively, but never by default nor beforehand, and the sites aren't checked regularly, either. The padlock isn't a sign of a trustworthy site, but of a secured connection!