whackThe malware that shows scanners a clean page
A cloaked link serves a clean page to scanners and malware to real visitors. Every reputation engine that checked one recent case rated it safe for months, because each engine looked from a single datacenter IP. Seeing the real behavior takes loading the same URL from several vantage points at once.
Most link checks ask one question from one place, then report what came back.
That worked when a bad link was bad for everyone. It stopped working when attackers started deciding what to show based on who appears to be asking.
I ran into a textbook case earlier in 2026. A fully authenticated Carnival Cruise Line email, booking number and all, routed real customers into malware installers and fullscreen lockers. The scanners that guard inboxes and browsers saw nothing wrong.
The investigation, the payloads and the takedown are written up in full on the research site: A real Carnival Cruise Line email was serving customers malware.
This piece covers the detection problem underneath it.
What the cloak does
The malicious landing page fingerprints the visitor and makes a per-visit decision.
Scanners, command-line tools and headless browsers fail the check and receive a harmless skeleton. Real browsers on real networks get routed to the live payload.
The gate is cheap to run and it is templated. urlscan.io flagged the page as one of "10,000+ similar pages."
The reputation services I checked returned clean verdicts, consistent with those services having received the skeleton rather than the payload. The link then inherited full brand trust, arriving through the sender's real click-tracker from a domain that passed every email authentication check.
This machinery already has a name
Trinity Cyber documented the redirection layer and the payload family in November 2025, in Blurred Lines: AdTech Abuse Delivers Browser Hijackers Through the Microsoft Store. Tanner Piliego and Jared Grumbein named the redirection layer PseudoTDS and the browser-hijacker family PhantomJack.
Their victims arrived by mistyping a domain. Ours arrived through an authenticated marketing email, which is a different door into the same building.
Both names in this piece are theirs. The reason it is worth revisiting is that the machinery is still running.
A clean verdict describes one observation
A scan result is a record of what one client saw at one moment from one network. Treating it as a property of the URL is where the reasoning breaks.
That distinction stays invisible while most bad links behave the same way for everyone. It becomes the whole problem once the page starts choosing.
Under a cloak, "clean" is a true statement about the observation and a false statement about the URL. Both halves are worth holding at once, because it means a defender who checked in good faith and found nothing was reading an accurate result.
The same applies to a verdict that ages. These pages rotate what they serve between visits, so a result from last week describes a page that no longer exists.
What the scanner missed
A visitor who cleared the fingerprint check landed somewhere quite different. The Windows branch served PhantomJack as forced installers of about 148 MB, signed with three-day certificates that had already expired.
Automated checks rated that domain safe throughout. The divergence between the two results is the entire finding.
Two of the packages went further. They shipped a forced auto-update channel that checks on every launch, runs in the background, and accepts any version the operator offers. The manifest is quoted in full in the research writeup.
Why one vantage point cannot catch it
A cloak only has to satisfy the observer it can see.
If your check comes from a single datacenter IP running a headless browser, that is the exact profile the cloak is tuned to feed a clean page. You are the input it was built for.
The tell appears when you load the same URL from several profiles at once and compare. Datacenter, residential and mobile.
In this case the split was stark. Blank and benign from the scanner, a forced malware download from the phone. That disagreement is the signal, and no single vantage point produces it.
The page fights the analyst too
Cloaking sorts the traffic. A second layer works on whoever gets through and starts looking closely.
Opening developer tools froze the page on a debugger trap assembled at runtime, with no literal debugger token in the source for a scanner to match on. The same layer watches for console evaluation and injected extensions, and reports back to the operator.
Both layers point the same direction. Automated collection captures the skeleton, and manual analysis is slowed down enough to make the sample expensive to pin down before it rotates.
Why an emailed link is the harder case
The prior reporting on this machinery describes victims who mistyped a domain. That victim has one thing going for them: they know they made a mistake, and the page they land on is unfamiliar.
An authenticated brand email removes every one of those cues. The sender is real, the message is expected, the booking number is correct, and the link opens from a domain the recipient has trusted for years.
That inverts where the detection burden sits. A typosquat has a suspicious human in the loop who might close the tab. Authenticated brand mail hands the whole job to whatever automated check runs before the click.
The check in this case was the one thing the cloak was built to defeat. Both halves of the pipeline were working correctly and the outcome was still malware, because each half was answering a question the other one assumed had been covered.
Email authentication proves the sender. It says nothing about where the links inside go, and a link is only as trustworthy as whoever currently owns the domain at the other end of it.
The blocklist is chasing the wrong layer
I rescanned the chain on September 10th, 2026. The hosts named in the 2025 reporting have moved on, and the build behind the Carnival link has not.
Of 12 redirect-hop domains I checked, 11 came back as dead parked pages: six lowercase letters plus .com, bulk-registered, first seen the same month, all sitting on one parking IP.
Blocking that layer buys little when a replacement costs a registration fee. The command-and-control naming carried across both reporting sets on rotated apexes, which is consistent with one operation continuing while its address list turned over.
Most of that layer is still unmapped, and I am staying on it. What survived rotation was the delivery kit itself. The request paths, the event names and a fixed parameter prefix stayed identical across unrelated brand domains, which makes that grammar the more durable thing to detect on.
Domain reputation answers where a request went. Behavior answers what it did. Only the second one survives the operator buying new domains.
This report covers what the requests did and how the chain responded to abuse reports. The commercial terms behind it are outside what I can observe, so nothing here characterizes intent.
What multi-vantage checking does not solve
Comparing several vantage points catches a page that discriminates by network or device. Naming the limits matters as much as claiming the win.
A page that gates on a session cookie, a referrer, a one-time click token or the time of day can still show every one of your profiles the same thing. Plenty of these chains do exactly that, which is why the tokenized links in the Carnival case expired into an error page rather than replaying.
Single-serving behavior defeats a retry in the same way. Where a chain burns the payload once per address, the confirming second look comes back clean and the first result starts to read like a fluke.
It also proves divergence rather than intent. A page serving different content by geography may be a cloak or may be a licensing rule.
The result is a signal that needs a human read. It narrows the field from every link to the handful behaving inconsistently, and that is the useful part.
What to do about it
Treat a scan verdict as evidence with a timestamp and an observer attached, rather than a durable property of a URL.
Check from more than one egress when the answer matters, and compare the results instead of accepting the first one. A single agreement across profiles is worth more than any individual verdict.
Detect on behavior that survives rotation: request-path grammar, event names, parameter shapes and download prompts. Domain lists go stale by design.
Recheck anything reached from mail you did not send yourself. The FBI's IC3 published PSA I-061826-PSA on June 18th, 2026, on criminals routing victims through traffic distribution systems to malicious sites, and this threat class remains invisible to a check that looks from one place.
What surfaces it
A single-vantage check gave every defender in that chain a false all-clear for months. A multi-vantage check shows the split the first time anyone looks.
That is what whack.sh does: load a URL from several real vantage points at once and surface the divergence.
When a link behaves one way for a scanner and another way for a phone, you want to see both.
If you check links, check them from more than one place. If you would rather not build that yourself, that is what whack.sh is for.
Full technical writeup, indicators of compromise and the downloadable whitepaper are on the research site: tuxxin.com. For coordinated disclosure or the full evidence package: [email protected].