Loading story…
A credential-phishing page hosted at addresses[.]performs[.]vu served a different obfuscated JavaScript and HTML variant on nearly every request, frustrating detections based on hashes, fixed strings, or static page signatures. Across 50 automated retrievals, every sample had a distinct SHA-256 hash; 49 were successfully deobfuscated, demonstrating a conventional phishing workflow concealed behind continuously changing client-side code.
One variant caused a browser to consume an entire CPU core and hang during decoding because nested JavaScript loops reused an undeclared global counter, resulting in an infinite loop. The defect appeared in two of roughly 56 collected samples, suggesting the operation uses a polymorphic obfuscator that randomly renames and reorders code but mishandles variable scope—not confirmed LLM-generated content. Defenders should use behavioral and runtime inspection of suspicious pages rather than relying solely on static indicators.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
KnowBe4 observed a .vu-domain phishing operation that seeded infrastructure in April 2026 and used 1,660 confirmed malicious domains to distribute 28,167 phishing emails through July. The campaign primarily targeted U.S. organizations and used embedded links leading to adversary-in-the-middle phishing sites that harvested credentials and intercepted MFA session tokens.
An automated collection of 50 responses from the same URL produced 50 distinct SHA-256 hashes and 21 page titles; 49 variants deobfuscated successfully while one had the same endless-loop failure. The recurring variable-scope bug indicated that the polymorphic generation mechanism could produce non-functional phishing pages.
One sampled phishing-page variant failed to render for about 30 seconds and consumed an analysis VM CPU core because nested JavaScript loops reused an undeclared global counter, producing an endless loop. Declaring a separate local counter allowed the payload to be decoded.
A phishing message linked recipients to addresses[.]performs[.]vu/communications.html, which served a credential-harvesting page. Repeated requests returned functionally similar pages with polymorphic JavaScript and HTML intended to evade hash- and string-based detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcemalware.news
Open sourceisc.sans.edu
Open sourceakamai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate web payloads were found to contain heavily obfuscated JavaScript, and in one case WebAssembly, designed to collect detailed browser and device telemetry from visitors. The scripts gathered data such as **canvas** and **WebGL** fingerprints, browser and platform characteristics, storage and service worker status, permissions, performance metrics, WebRTC-derived local IP information, geolocation status, and error telemetry, then packaged the results into structured records for later processing or transmission. Embedded logic also pointed to anti-fraud and anti-automation use cases, including anti-debugging checks, bot-detection routines, URL interception, cookie and session handling, hashing with `SHA-1` and `SHA-256`, and checks for incognito mode or tampering. One payload included strings associated with **DataDome** and a Rust-to-WASM build pipeline, while the other contained anti-fraud checks such as canvas-noise detection and a **Buhtrap**-related detector, indicating sophisticated client-side tracking and detection capabilities rather than a clearly documented breach or vulnerability event.
Aug 14, 2026
Cybercriminals are increasingly using **HTML attachments** in phishing emails to evade detection and steal credentials, embedding malicious logic directly in attached files instead of placing suspicious links in the message body. The attachments commonly use JavaScript to redirect victims to fraudulent login pages or to display a complete phishing page locally inside the browser, making the email appear less obviously malicious to both users and some security controls. Researchers found that attackers also obfuscate these attachments to hinder static analysis, including hiding phishing URLs, concealing entire scripts, and using deprecated JavaScript functions such as `unescape()` to decode and render phishing content at runtime. Kaspersky reported detecting nearly **2 million** emails carrying malicious HTML attachments in the first four months of 2022, including **851,328** blocked in March alone, underscoring how effective and persistent the technique remains for credential-harvesting campaigns.
Aug 15, 2026
Researchers reported that malicious email attachments disguised as JavaScript files were being used to deliver a broad set of remote access Trojans and stealers through heavily obfuscated loader chains. HP Wolf Security identified the activity as **RATDispenser**, a stealthy JavaScript loader that decodes itself, launches `cmd.exe`, writes a VBScript file into `%TEMP%`, and then either drops or downloads a second-stage payload. Analysis of 155 samples found that **94%** acted as droppers rather than network downloaders, with **STRRAT** and **WSHRAT** making up **81%** of observed payloads; other delivered malware included **Formbook**, **Remcos**, **AdWind**, **Panda Stealer**, **GuLoader**, and **Ratty**. The campaign’s low average detection rate and layered obfuscation indicated an effective distribution mechanism for commodity malware. Separate analysis of a phishing campaign targeting European organizations showed a similar JavaScript-to-VBS infection pattern delivering **H-Worm/Houdini** after emails impersonating entities such as **UNWTO** and **IATA**. Lab52 attributed that operation to **LazyScripter** and found that the attackers’ obfuscated scripts had themselves been tampered with by the online service `hackfree.org`, which injected an additional **njRAT** downloader, creating a double-compromise scenario. Researchers linked the primary campaign to infrastructure including `stub.ignorelist.com` and `securessl.fit`, while the injected secondary activity used a PowerShell downloader that contacted `185.81.157.186` to retrieve content from `/NDA/199.png`, underscoring how obfuscated JavaScript loaders were being reused to distribute multiple RAT families through phishing.
Aug 15, 2026