Polymorphic Phishing Page at addresses.performs.vu Regenerates Its Code on Every Load, Defeating Hash-Based Detection

Polymorphic Phishing Page at addresses.performs.vu (TL-2026-2183) is a medium-severity phishing campaign, first published 2026-08-28. It has no confirmed attribution, maps to 10 MITRE ATT&CK techniques (T1027, T1027.003, T1027.014), and is covered by 9 detection rules and 5 indicators of compromise.

Key facts for TL-2026-2183

Threat ID
TL-2026-2183
Severity
MEDIUM
Status
ACTIVE
Category
PHISHING
First published
2026-08-28
Last reviewed
2026-08-28
Attribution confidence
LOW
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
5

Malware and tooling in Polymorphic Phishing Page at addresses.performs.vu

Malware and tooling: Conventional polymorphic JavaScript obfuscator (specific tool/vendor unidentified)

SANS Internet Storm Center handler Jan Kopriva documented a live credential-phishing page at addresses.performs.vu that regenerates its HTML/JavaScript on every request, randomizing function/variable names, form fields, CSS classes, numeric constants, and hidden zero-width characters so that 50 sampled loads produced 50 distinct SHA-256 hashes. A coding flaw in the obfuscator itself (two decoding routines sharing the undeclared global variable k) trapped roughly 2 of 56 samples in an infinite loop, stalling the browser for ~30 seconds at 100% single-core CPU.

How Polymorphic Phishing Page at addresses.performs.vu works

On 2026-08-27, a SANS ISC handler received a phishing email containing a link of the form hxxps[:]//addresses.performs.vu/communications.html?good=[recipient_address] (the good= parameter carries the target's own email address for personalization). Visiting the link triggered a heavily obfuscated JavaScript decoding routine that took roughly 30 seconds to execute while pinning a single CPU core to 100%, before rendering an otherwise unremarkable credential-stealing page whose observed titles included 'Solution', 'Viewer', 'Credentials', 'Private', and 'Authenticate'.

To characterize the server, the handler retrieved the URL 50 times via an automated script (plus manual attempts, ~56 samples total). Every one of the 50 scripted samples produced a distinct SHA-256 hash of the served page, and 21 distinct page titles were observed across the set — the server rewrites JavaScript function and variable names, HTML form/input names, CSS classes, and element identifiers on every request, expresses numeric constants through different arithmetic operations each time, and inserts hidden zero-width characters into visible strings. Deobfuscating the samples showed the underlying page logic and final payload were functionally identical across variants; only the surface representation changed.

The obfuscator itself contains a bug: two JavaScript functions, an outer loop counter in _il() (intended range 0-64) and a Base64-alphabet helper _YF(), both rely on an undeclared (implicitly global) variable k. Repeated calls to _YF(47,47) reset k to 48 each time, and the outer loop's increment then advances it to 49 without ever breaking the cycle, producing an endless 48-to-49-to-48 loop. This flaw caused roughly 2 of 56 collected samples (about 3.6%) to hang indefinitely rather than render, meaning the anti-detection mechanism itself intermittently breaks the phishing page it protects.

The handler assessed that a conventional polymorphic JavaScript obfuscator, not an LLM-based code generator, most likely produced the variants, based on the systematic, mechanical nature of the transformations and the type of bug observed (a classic scoping error consistent with automated random renaming/reordering tooling) — contrasted against Unit 42's January 2026 proof-of-concept for LLM-generated, per-visit malicious JavaScript delivered through trusted AI-provider domains. No BeaconBeagle correlation, associated IPs, or additional infrastructure for addresses.performs.vu were found at analysis time; the domain sits on the .vu (Vanuatu) ccTLD, an extension increasingly abused for phishing due to minimal registration verification and default WHOIS privacy, as separately documented in unrelated .vu-hosted phishing campaigns (e.g., ioloo.vu) reported around the same period.

MITRE ATT&CK techniques used in TL-2026-2183

Defense Evasion

T1027 Obfuscated Files or Information; T1027.003 Steganography; T1027.014 Polymorphic Code; T1140 Deobfuscate/Decode Files or Information; T1684.001 Impersonation

Execution

T1204.001 Malicious Link

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1608.005 Link Target

Reconnaissance

T1598.003 Spearphishing Link

Remediation for Polymorphic Phishing Page at addresses.performs.vu

Immediate actions

  • Block and monitor for the domain addresses.performs.vu and the URL path /communications.html?good= at email and web gateways
  • Instruct any user who clicked the link to treat entered credentials as compromised: reset passwords and review MFA/session state
  • Hunt proxy, DNS, and email-gateway logs for outbound requests to addresses.performs.vu or similarly structured .vu credential-phishing links

Workarounds

  • Train users to verify unexpected sign-in or document-viewer prompts through a known-good channel (not the link itself) before entering credentials

Longer-term hardening

  • Shift email/web filtering toward behavior- and DOM-structure-based detection rather than static file-hash or exact-string signatures, since this page produces a unique SHA-256 hash on every load
  • Add a heuristic for anomalous ~30-second page-load stalls with single-core CPU pinning during link-click telemetry, which corresponds to this obfuscator's known reused-variable bug
  • Extend brand-impersonation and credential-phishing detection coverage to rarely-abused ccTLDs such as .vu, which accumulate fewer abuse reports and evade reputation-based blocklists longer than common gTLDs

Timeline of Polymorphic Phishing Page at addresses.performs.vu

  • SANS Internet Storm Center published Jan Kopriva's diary 'A polymorphic phishing page (that occasionally breaks itself)' documenting the findings.
  • Deobfuscation of the samples revealed that two JavaScript functions, _il() and _YF(), share an undeclared global variable k, trapping approximately 2 of 56 samples in an endless 48-to-49 loop and explaining the CPU-stall/failure cases.
  • All 50 scripted samples produced distinct SHA-256 hashes of the served page, and 21 distinct page titles were observed across the sample set.
  • An automated script retrieved the phishing URL 50 times (plus manual attempts, ~56 samples total) to characterize the server's polymorphic output.
  • The handler followed the link and observed the browser stall for approximately 30 seconds at 100% single-core CPU utilization before the credential-phishing page rendered.
  • A SANS ISC handler received a phishing email containing a link to hxxps[:]//addresses.performs.vu/communications.html?good=[recipient_address].
  • TL-Intel's HUNT phase ingested the Cyber Security News article via RSS and flagged the live polymorphic phishing infrastructure for research.
  • Cyber Security News republished and summarized the SANS ISC findings as 'Hackers Make Phishing Pages Change Their Code Every Time Someone Opens Them.'

Sources cited for Polymorphic Phishing Page at addresses.performs.vu

More in phishing

Detection coverage for TL-2026-2183

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2183 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats