wildcard[.]krakenapp[.]link

This domain, wildcard.krakenapp.link, operates as a confirmed credential harvesting site targeting users of the Kraken cryptocurrency exchange. The infrastructure presents a fraudulent login interface designed to capture usernames, passwords, and multi-factor authentication codes. Analysis of the page title, 'Checking your browser...', indicates the use of anti-bot mechanisms to filter potential victims and evade automated security scans, a common tactic in targeted phishing campaigns. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on May 02, 2026, through GMO Internet, Inc. d/b/a Onamae.com, and resolves to the IP address 139.162.181.76, hosted in Germany by Linode. Security vendor detections on VirusTotal stand at 12 out of 95, while the domain appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R13), providing a veneer of legitimacy while failing to mitigate the underlying threat. Users who have visited wildcard.krakenapp.link or entered credentials on the site should immediately revoke any active sessions on the legitimate Kraken platform. Reset passwords and enable multi-factor authentication if not already active. Monitor accounts for unauthorized transactions and report any suspicious activity to the exchange's security team. Avoid interacting with the domain or any associated links, as the infrastructure remains active and may deploy additional malicious payloads.