Between April and July 2026, KnowBe4 ThreatLabs added 1,660 domains ending in .vu, Vanuatu’s country-code extension, to its global phishing blocklist. That is a 159.6% jump over the prior period, tied to 28,167 phishing emails across Education, Manufacturing, Government, and Financial sector targets, overwhelmingly in the United States. The number worth sitting with is not the growth rate. It is this one: 99.9% of those malicious .vu domains showed up inside the body of an email, in a link, never once as the address the message claimed to be from.
A Registry Built for Speed, Not Scrutiny
Vanuatu’s .vu registry asks for none of the friction that slows down abuse elsewhere. No strict identity verification, bulk pricing for buying domains by the dozen, and default WHOIS privacy that hides who registered what. KnowBe4 found the average .vu domain in these campaigns lived about 20 days from registration to abandonment, long enough to run a wave of email and short enough to be gone before most blocklists caught up. Because security vendors have historically seen almost no legitimate .vu traffic, the extension carried no built-in reputation signal in either direction. It was simply invisible, and invisible is exactly what a disposable phishing domain wants to be.
The Kit Behind the Domains
Technical fingerprints across the .vu infrastructure point to Sneaky2FA, an adversary-in-the-middle phishing kit that does not try to guess a password. It proxies the entire login session in real time: the victim types their real credentials into a page that forwards them live to the real service, completes their own multi-factor challenge exactly as they would on any normal day, and the kit lifts the authenticated session token the instant it comes back. From the account owner’s perspective, nothing looked wrong, because nothing about the login itself was fake. Only the page relaying it was.
Why DMARC Was Never in a Position to Help
DMARC, SPF, and DKIM all answer one question, and only one: is this message authorized to claim the sending domain in its From header? None of these campaigns needed to answer that question dishonestly, because none of them put a .vu address in the From field. The email itself typically arrived from a domain with clean, aligned authentication, sometimes a compromised mailbox, sometimes a freshly registered lookalike that passed its own checks honestly. The .vu domain only appeared several steps downstream, as a link the recipient was invited to click. DMARC evaluates the envelope. It has no mechanism for evaluating a URL sitting in the message body, and it was never designed to.
This is a distinct failure mode from a spoofed sender or a hijacked account, the shape of problem this blog covers constantly. Here, authentication was never even relevant to begin with, because the part of the message that mattered, the destination the victim actually reached, sits entirely outside what DMARC was built to inspect. Sender-based filtering, whether that is DMARC or a mail gateway’s domain reputation list, is structurally blind to a threat that never claims to be the sender.
What This Means for Your Program
Domain authentication and link inspection are two different jobs, and neither one covers for the other. DMARC tells you whether a message honestly represents its sending domain. It says nothing about what any link inside that honest message points to. A security program that treats DMARC enforcement as complete protection has covered exactly one entry point out of several.
Country-code TLDs with weak registration controls deserve their own scrutiny layer, separate from sender reputation. A URL filter or secure email gateway that only weighs sender domain history will miss infrastructure like this by design. Look for filtering that evaluates link destinations against TLD-level risk, not just the domain in the From header.
A phishing-resistant sign-in method is the control that actually stops Sneaky2FA, because it stops working even after a click. AiTM kits succeed by relaying a live session; a FIDO2 security key or platform passkey does not produce a token the kit can steal in transit the way a typed password and OTP code can. Where MFA still relies on a code a user types in, this class of attack keeps working regardless of how clean your email authentication looks.
Short-lived domains need short-lived trust. A domain registered 20 days ago carrying business-critical volume is not a normal pattern for most organizations’ legitimate vendors. Flagging newly registered domains in links, independent of whether the sending domain passed DMARC, catches exactly the gap this campaign is built to exploit.
The Takeaway
None of the mail carrying these 28,167 messages needed to break DMARC, SPF, or DKIM, because none of it asked those checks a question they were built to answer. The .vu surge is a reminder that email authentication protects the identity of the sender, not the safety of every destination a message can point you toward. A domain with a clean DMARC record can still deliver a link to infrastructure built and abandoned in twenty days, and the two facts have nothing to do with each other.
DMARC confirms who sent a message. It was never meant to tell you where every link inside it leads. Excello Mail gives you continuous, plain-language visibility into your domain’s authentication posture, so you can see clearly what DMARC actually covers, and build the rest of your defense around what it does not. Sign up for free to Excello Mail and get a clear picture of your real authentication coverage today.