nuventis[.]online

This domain, nuventis.online, is actively engaged in credential theft campaigns targeting enterprise users through the impersonation of corporate single sign-on (SSO) portals and internal authentication pages. Analysis of collected samples and redirect chains indicates the site presents highly convincing replicas of Microsoft 365, Okta, and custom enterprise login interfaces, designed to harvest usernames, passwords, and multi-factor authentication tokens. The threat actor employs dynamic content injection based on victim IP geolocation and user-agent strings to serve region-specific login pages, increasing the likelihood of successful compromise. The infrastructure supports session persistence through browser fingerprinting and cookie-based tracking, suggesting an intent to maintain access for follow-on exploitation or lateral movement within compromised networks. Infrastructure analysis reveals nuventis.online was registered on June 27, 2026, through Dynadot Inc, a registrar frequently observed in phishing operations due to its low-cost domain offerings and minimal registration friction. The domain resolves to the IP address 69.49.241.79, hosted on a bulletproof provider known for tolerating malicious activity. As of the latest scan, 18 out of 95 security vendors on VirusTotal flag the domain as malicious, with detections including credential phishing, social engineering, and suspicious domain classification. AlienVault OTX records the domain in one threat intelligence pulse, though no specific campaign attribution has been established. The site employs a Let's Encrypt SSL certificate, providing HTTPS encryption to lend an appearance of legitimacy while evading basic network-based detection. Users who have visited nuventis.online or entered credentials on any page hosted under this domain should assume compromise and take immediate remediation steps. Rotate all passwords for enterprise accounts, personal email, and any services where credentials may have been reused. Enable multi-factor authentication using app-based or hardware tokens, avoiding SMS or email-based methods vulnerable to interception. Review recent login activity for unauthorized access, particularly from unfamiliar IP addresses or devices. If corporate credentials were exposed, notify internal security teams to initiate incident response procedures, including revoking active sessions and scanning for indicators of compromise. Monitor financial and identity-related accounts for signs of fraud, as credential theft often precedes account takeover or identity theft. Network administrators should block the domain and IP at perimeter controls and add detection rules for related infrastructure patterns.