Skip to navigation

Threat reportPhishingTL-2026-2183

Polymorphic Phishing Page at addresses.performs.vu Regenerates Its Code on Every Load, Defeating Hash-Based Detection

mediumACTIVE

SANS Internet Storm Center handler Jan Kopriva documented a live credential-phishing page at addresses.performs.vu that regenerates its HTML/JavaScript on every request, randomizing function/variable names, form fields, CSS classes, numeric constants, and hidden zero-width characters so that 50 sampled loads produced 50 distinct SHA-256 hashes.

Key facts for Self-breaking polymorphic phishing

IdentifiersTL-2026-2183
SeverityMEDIUM
Exploitation statusExploited in the wild
ToolsConventional polymorphic JavaScript obfuscator (specific tool/vendor unidentified)
MITRE ATT&CK techniquesT1027 Obfuscated Files or Information, T1027.003 Steganography, T1027.014 Polymorphic Code, T1140 Deobfuscate/Decode Files or Information, T1204.001 Malicious Link, T1566.002 Spearphishing Link, T1583.001 Domains, T1598.003 Spearphishing Link, T1608.005 Link Target, T1684.001 Impersonation
MotivationUNKNOWN
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Self-breaking polymorphic phishing

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2183 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Phishing Link Click to addresses.performs.vu Polymorphic Credential Page — SPL

Detects a proxy or email-gateway request for the live polymorphic credential-phishing page at addresses.performs.vu/communications.html, personalized via a good= query parameter carrying the target's own email address. Covers the initial-access spearphishing-link click and the recipient-targeting technique used to stage it.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1566.002, T1598.003, T1204.001
  • Data sources: web_proxy, email_gateway, dns
  • Severity: high
  • Confidence: high

Splunk SPL

index=proxy sourcetype="web_proxy" earliest=-24h
| eval url_domain=lower(url_domain)
| where url_domain="addresses.performs.vu" OR match(url, "(?i)addresses\.performs\.vu\/communications\.html")
| rex field=url "good=(?<recipient_param>[^&\s]+)"
| table _time, src_ip, src_user, url, recipient_param, http_user_agent, http_referrer, action
| sort -_time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "addresses.performs.vu" and RemoteUrl has "/communications.html"
| extend RecipientParam = extract(@"good=([^&\s]+)", 1, RemoteUrl)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RecipientParam, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Phishing Link Click to addresses.performs.vu Polymorphic Credential Page
id: 8f2a1c4e-6b3d-4e7a-9f21-3d5b7c9a1e02
status: experimental
description: Detects a proxy/web request to the known polymorphic credential-phishing domain addresses.performs.vu, path /communications.html, personalized via a good= recipient-email query parameter.
references:
  - https://isc.sans.edu/diary/33290
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.reconnaissance
  - attack.t1598.003
  - attack.execution
  - attack.t1204.001
logsource:
  category: proxy
  product: web
detection:
  selection_domain:
    c-uri-host|contains: 'addresses.performs.vu'
  selection_path:
    c-uri|contains:
      - '/communications.html'
      - 'good='
  condition: selection_domain and selection_path
falsepositives:
  - None expected; domain is not known for any legitimate use
level: high

Known false positives:

  • Security-research or threat-intel automation retrieving the URL for analysis/sandboxing (as SANS ISC itself did via an automated script)
  • Automated URL-reputation crawlers or secure-email-gateway link-detonation services following the link from a received email

Tuning notes: Scope url_domain/RemoteUrl matching to the exact registered domain addresses.performs.vu (and watch for near-neighbor typosquats on performs.vu) rather than a broad .vu wildcard here — the broader rare-TLD heuristic belongs on the infrastructure row (TL-2026-2183-*-003). Extract and alert on the good= parameter value to identify the targeted recipient without waiting for a help-desk report.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Phishing Link Click to [indicator] Polymorphic Credential Page — KQL · unlock with TL Creds
  • Credential Submission or Browser CPU-Pin Anomaly on Polymorphic Phishing Page — KQL · unlock with TL Creds
  • Sustained or Repeated Outbound Session to Rare .vu ccTLD Phishing Infrastructure — KQL · unlock with TL Creds
  • Phishing Link Click to [indicator] Polymorphic Credential Page — Sigma · unlock with TL Creds
  • Credential Submission or Browser CPU-Pin Anomaly on Polymorphic Phishing Page — Sigma · unlock with TL Creds
  • Sustained or Repeated Outbound Session to Rare .vu ccTLD Phishing Infrastructure — Sigma · unlock with TL Creds
  • Credential Submission or Browser CPU-Pin Anomaly on Polymorphic Phishing Page — SPL · unlock with TL Creds
  • Sustained or Repeated Outbound Session to Rare .vu ccTLD Phishing Infrastructure — SPL · unlock with TL Creds

Indicators of compromise for Self-breaking polymorphic phishing

As of 2026-08-28, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-2183.

Sample indicators (1 of 5)

  • Domain: addresses[.]performs[.]vu

Defanged, TLP:CLEAR. Full set of 5 indicators: unlock with TL Creds.

5 indicators of compromise · unlock with TL Creds. Compare plans

How Self-breaking polymorphic phishing works

A coding flaw in the obfuscator itself (two decoding routines sharing the undeclared global variable k) trapped roughly 2 of 56 samples in an infinite loop, stalling the browser for ~30 seconds at 100% single-core CPU.

On 2026-08-27, a SANS ISC handler received a phishing email containing a link of the form hxxps[:]//addresses.performs.vu/communications.html?good=[recipient_address] (the good= parameter carries the target's own email address for personalization). Visiting the link triggered a heavily obfuscated JavaScript decoding routine that took roughly 30 seconds to execute while pinning a single CPU core to 100%, before rendering an otherwise unremarkable credential-stealing page whose observed titles included 'Solution', 'Viewer', 'Credentials', 'Private', and 'Authenticate'.

To characterize the server, the handler retrieved the URL 50 times via an automated script (plus manual attempts, ~56 samples total). Every one of the 50 scripted samples produced a distinct SHA-256 hash of the served page, and 21 distinct page titles were observed across the set — the server rewrites JavaScript function and variable names, HTML form/input names, CSS classes, and element identifiers on every request, expresses numeric constants through different arithmetic operations each time, and inserts hidden zero-width characters into visible strings. Deobfuscating the samples showed the underlying page logic and final payload were functionally identical across variants; only the surface representation changed.

The obfuscator itself contains a bug: two JavaScript functions, an outer loop counter in _il() (intended range 0-64) and a Base64-alphabet helper _YF(), both rely on an undeclared (implicitly global) variable k. Repeated calls to _YF(47,47) reset k to 48 each time, and the outer loop's increment then advances it to 49 without ever breaking the cycle, producing an endless 48-to-49-to-48 loop. This flaw caused roughly 2 of 56 collected samples (about 3.6%) to hang indefinitely rather than render, meaning the anti-detection mechanism itself intermittently breaks the phishing page it protects.

The handler assessed that a conventional polymorphic JavaScript obfuscator, not an LLM-based code generator, most likely produced the variants, based on the systematic, mechanical nature of the transformations and the type of bug observed (a classic scoping error consistent with automated random renaming/reordering tooling) — contrasted against Unit 42's January 2026 proof-of-concept for LLM-generated, per-visit malicious JavaScript delivered through trusted AI-provider domains. No BeaconBeagle correlation, associated IPs, or additional infrastructure for addresses.performs.vu were found at analysis time; the domain sits on the .vu (Vanuatu) ccTLD, an extension increasingly abused for phishing due to minimal registration verification and default WHOIS privacy, as separately documented in unrelated .vu-hosted phishing campaigns (e.g., ioloo.vu) reported around the same period.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.003 Steganography; T1027.014 Polymorphic Code; T1140 Deobfuscate/Decode Files or Information; T1684.001 Impersonation

Execution

T1204.001 Malicious Link

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1608.005 Link Target

Reconnaissance

T1598.003 Spearphishing Link

Remediation for Self-breaking polymorphic phishing

Immediate actions

  • Block and monitor for the domain addresses.performs.vu and the URL path /communications.html?good= at email and web gateways
  • Instruct any user who clicked the link to treat entered credentials as compromised: reset passwords and review MFA/session state
  • Hunt proxy, DNS, and email-gateway logs for outbound requests to addresses.performs.vu or similarly structured .vu credential-phishing links

Workarounds

  • Train users to verify unexpected sign-in or document-viewer prompts through a known-good channel (not the link itself) before entering credentials

Longer-term hardening

  • Shift email/web filtering toward behavior- and DOM-structure-based detection rather than static file-hash or exact-string signatures, since this page produces a unique SHA-256 hash on every load
  • Add a heuristic for anomalous ~30-second page-load stalls with single-core CPU pinning during link-click telemetry, which corresponds to this obfuscator's known reused-variable bug
  • Extend brand-impersonation and credential-phishing detection coverage to rarely-abused ccTLDs such as .vu, which accumulate fewer abuse reports and evade reputation-based blocklists longer than common gTLDs

Timeline of Self-breaking polymorphic phishing

  • SANS Internet Storm Center published Jan Kopriva's diary 'A polymorphic phishing page (that occasionally breaks itself)' documenting the findings.
  • Deobfuscation of the samples revealed that two JavaScript functions, _il() and _YF(), share an undeclared global variable k, trapping approximately 2 of 56 samples in an endless 48-to-49 loop and explaining the CPU-stall/failure cases.
  • All 50 scripted samples produced distinct SHA-256 hashes of the served page, and 21 distinct page titles were observed across the sample set.
  • An automated script retrieved the phishing URL 50 times (plus manual attempts, ~56 samples total) to characterize the server's polymorphic output.
  • The handler followed the link and observed the browser stall for approximately 30 seconds at 100% single-core CPU utilization before the credential-phishing page rendered.
  • A SANS ISC handler received a phishing email containing a link to hxxps[:]//locked-ioc-4/communications.html?good=[recipient_address].
  • TL-Intel's HUNT phase ingested the Cyber Security News article via RSS and flagged the live polymorphic phishing infrastructure for research.
  • Cyber Security News republished and summarized the SANS ISC findings as 'Hackers Make Phishing Pages Change Their Code Every Time Someone Opens Them.'

Sources cited for Self-breaking polymorphic phishing

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats