midfloridacu[.]at

This domain, midfloridacu.at, is actively engaged in credential harvesting by impersonating the legitimate online banking portal of MidFlorida Credit Union. Analysis indicates the site is designed to mimic the authentic login interface, tricking users into submitting sensitive financial credentials, including usernames, passwords, and multifactor authentication codes. The threat extends to potential account takeover, unauthorized fund transfers, and identity theft, given the targeted nature of financial phishing campaigns. The domain is classified under the SOCIAL_ENGINEERING category, confirming its intent to deceive users through fraudulent representations of trust. Evidence supporting the malicious classification includes detection by 13 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it for SOCIAL_ENGINEERING. The domain was registered through Hosting Concepts B.V. via Registrar.eu, a provider frequently associated with bulletproof hosting and low-reputation registrations. Infrastructure analysis reveals the domain resolves to the IP address 107.189.26.168, an address previously linked to multiple phishing and malware distribution campaigns. The SSL certificate is issued by Let’s Encrypt, a common tactic to lend superficial legitimacy while avoiding the scrutiny of paid certificates. Additionally, AlienVault OTX records the domain in two distinct threat intelligence pulses, further corroborating its association with malicious activity. Users who have visited midfloridacu.at or entered credentials on the site should immediately take corrective action. First, revoke any active sessions on the legitimate MidFlorida Credit Union platform and change all associated passwords using a secure, non-compromised device. Enable multifactor authentication if not already active, and monitor account statements for unauthorized transactions. If financial data or personal information was submitted, contact the financial institution directly to report potential fraud and request account monitoring. Network administrators should block the domain and its resolving IP (107.189.26.168) at the perimeter to prevent further exposure. Users are advised to verify the legitimacy of any financial login portal by cross-referencing the URL with the official domain provided by the institution and looking for HTTPS indicators with a valid, organization-issued certificate.