upholddesktop[.]org

This domain, upholddesktop.org, was designed to deceive users into downloading a fraudulent version of the Uphold desktop application for Windows. The site mimicked legitimate download pages, likely aiming to distribute malware or harvest credentials from unsuspecting victims who believed they were installing a genuine financial application. Analysis indicates the site employed social engineering tactics to manipulate users into executing malicious files or entering sensitive information under false pretenses.

Infrastructure analysis reveals the domain was registered through Squarespace Domains LLC on June 18, 2026, an unusually future-dated creation that may indicate domain spoofing or registry manipulation. At the time of assessment, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, with detections including phishing and social engineering classifications. The domain resolved to the IP address 91.92.241.250 and appeared on four distinct security blocklists, including MetaMask and PhishDestroy, further confirming its malicious intent.

Users who visited upholddesktop.org or downloaded files from the site should immediately disconnect the affected device from networks and perform a full system scan using updated security tools. Any credentials entered on the site must be considered compromised and reset from a secure device. Monitor financial accounts and system logs for unauthorized activity, and report the incident to relevant security teams or fraud response units. If the fake application was executed, restore the system from a known clean backup or perform a clean operating system reinstall to ensure complete removal of potential malware.