fidelityworkplacehp[.]click

This domain, fidelityworkplacehp.click, poses as the legitimate Fidelity NetBenefits login portal to harvest user credentials. The site mimics the appearance and functionality of the real Fidelity workplace benefits platform, tricking employees into entering their login details, which are then captured by threat actors. Such stolen credentials can lead to unauthorized access to retirement accounts, financial theft, or further targeted attacks against corporate networks. Analysis indicates this domain was registered on February 21, 2026, and is hosted on an IP address (43.162.112.221) associated with infrastructure in the US under AS132203. The site was flagged by 17 out of 95 security vendors on VirusTotal, and it appears on two security blocklists. The SSL certificate (E7) and the page title, 'Log In to Fidelity NetBenefits,' further confirm its intent to deceive users into believing it is a legitimate Fidelity service. If you or someone in your organization visited fidelityworkplacehp.click and entered login credentials, immediate action is required. First, change the password for the affected Fidelity account and any other accounts using the same credentials. Enable multi-factor authentication (MFA) if not already active. Monitor the account for unauthorized transactions or changes, and report any suspicious activity to Fidelity’s official support channels. Additionally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads.