live-usdesktop[.]wixstudio[.]com

live-usdesktop.wixstudio.com is an active phishing domain masquerading as USDesktop, a legitimate technology support and hardware retailer. The site is currently hosting a live crypto drainer campaign, designed to trick users into connecting cryptocurrency wallets or entering seed phrases under the false pretense of a software update or support interaction. This campaign remains under active investigation as of the latest update, with threat actors leveraging a compromised WixStudio subdomain to host malicious JavaScript payloads commonly associated with wallet-draining malware. Users interacting with this domain risk immediate financial loss through unauthorized cryptocurrency transfers or credential theft. PhishDestroy analysis reveals that live-usdesktop.wixstudio.com has not yet been flagged by any of the 95 VirusTotal scanning vendors, indicating a low detection rate and high potential for successful user compromise. The domain is registered under Wix.com (via Wix Studios), resolving to IP 34.144.206.118. The SSL certificate is issued by Let's Encrypt, a trusted Certificate Authority, which may lower user suspicion. The subdomain was created recently, though exact creation timestamps are not publicly available in the dataset. Historical blocklist data (e.g., from Google Safe Browsing, OpenPhish, etc.) currently lists zero appearances, suggesting this is a newly deployed campaign. Domain trust scores (e.g., from Cisco Talos, PhishTank) are not yet available or remain neutral due to the domain’s recent activation. The campaign remains active and evolving, with threat actors likely distributing the link via fake support tickets, social media direct messages, or spoofed emails mimicking USDesktop branding. Given the absence of detection and reliance on a trusted hosting platform (Wix), the risk to uninformed users is significant. PhishDestroy recommends immediate blocking of the domain live-usdesktop.wixstudio.com at the network level and disabling access via DNS filtering. Users who may have visited the site are urged to revoke any wallet connections, perform a malware scan, and report the incident to PhishDestroy for further analysis. Organizations are advised to monitor for similar subdomains using WixStudio domains with cryptocurrency-related prefixes.