The .vu Surge: How Threat Actors Are Exploiting Vanuatu's Domain Extension

KnowBe4 Threat Lab observed a large, active phishing campaign (April–July 2026) that abused 1,660 short-lived .vu domains to host credential-harvesting and MFA-relay pages, delivering at least 28,167 malicious emails by separating clean sender domains from embedded .vu payload links; the report details campaign phases, registrars, sample IOCs, targeted sectors, and recommended defensive actions including blocking .vu at mail/DNS layers and retroactive hunting.