mission[.]wasmer[.]app

This domain, mission.wasmer.app, is identified as a high-risk phishing resource targeting Navy Federal Credit Union members. Analysis indicates the site replicates the legitimate financial institution’s branding, including the official page title 'Navy Federal Credit Union - Our Members are the Mission®', to deceive users into submitting sensitive credentials. The threat type is classified as generic phishing, with no evidence of a specialized drainer kit or advanced evasion techniques at this time. The infrastructure appears designed for rapid deployment and takedown, a common tactic in credential-harvesting campaigns. Infrastructure analysis reveals the domain resolves to the IPv6 address 2001:bc8:701:70a:d604:e6ff:fee8:ad60, hosted on AS12876 (Scaleway SAS) in France. The domain was registered through Squarespace Domains II LLC, a registrar frequently exploited for short-lived phishing operations due to its streamlined registration process. Detection metrics show 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on a single security blocklist, suggesting it evaded broader detection during its active window. As of the latest assessment, mission.wasmer.app has been taken offline, likely following abuse reports or automated takedown mechanisms. However, the risk of reemergence persists, as the underlying infrastructure and registration pattern remain conducive to rapid redeployment. Users who accessed the site during its active period should assume credential exposure and initiate password resets, while monitoring for unauthorized transactions. Organizations are advised to update blocklists with the provided indicators, including the IPv6 address and registrar details, to preempt future iterations of this campaign.