access[.]rricrosoft-office[.]org

This domain, access.rricrosoft-office.org, operates as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The site masquerades as a legitimate Microsoft Office authentication portal, exploiting visual and structural similarities to trusted services. Users who enter credentials on such pages risk account compromise, unauthorized access to personal or corporate data, and potential follow-on attacks such as identity theft or financial fraud. Analysis indicates the domain was registered on February 21, 2026, through Dynadot LLC, a known registrar frequently used in malicious infrastructure deployments. At the time of assessment, 17 out of 95 security vendors on VirusTotal had flagged the domain as malicious, reflecting broad consensus across detection engines. The domain resolved to the IP address 20.50.64.14, hosted on infrastructure belonging to AS8075 (Microsoft Corporation) in Ireland, a pattern observed in adversary-controlled or compromised cloud instances. The site displayed a page titled 'Phishing Simulation Notice,' a tactic often employed to lower user suspicion or simulate training environments while still capturing input data. If a user visited access.rricrosoft-office.org and entered credentials, immediate action is required. First, reset passwords for any accounts accessed or entered on the site, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unexpected login attempts, password change notifications, or unauthorized transactions. Users should also review connected applications and revoke access for any unknown or suspicious integrations. Organizations should consider isolating affected devices from corporate networks until a security review is conducted to rule out malware or lateral movement risks.