lkdfjbvnyt927[.]cn

This domain, lkdfjbvnyt927.cn, is an active credential theft site designed to harvest Microsoft account logins. Attackers use fake login portals mimicking legitimate Microsoft services to trick users into submitting usernames, passwords, and multi-factor authentication codes. The stolen credentials are often used for unauthorized account access, financial fraud, or further phishing campaigns targeting contacts in compromised accounts. Analysis indicates the domain was registered on March 25, 2026, through Web Commerce Communications Limited, a registrar frequently associated with malicious infrastructure. As of the latest scan, 21 out of 95 security vendors on VirusTotal flag this domain as malicious, and it appears on one security blocklist. The creation date suggests an attempt to evade detection by using a domain that appears newly registered, while the registrar choice aligns with patterns observed in credential theft operations. If you visited lkdfjbvnyt927.cn and entered login details, immediately reset your Microsoft account password using a separate, trusted device. Enable multi-factor authentication if not already active, and review recent account activity for unauthorized access. Check connected devices and revoke access for any unfamiliar sessions. Monitor financial accounts linked to the compromised email for suspicious transactions, and consider notifying contacts that your account may have been used to send phishing messages. Report the incident to your organization’s security team if the account is work-related.