macs-store[.]app

PhishDestroy identifies macs-store.app as an active brand impersonation scam masquerading as a legitimate Apple Store website to harvest user credentials and drain cryptocurrency wallets. This domain leverages Apple’s branding to trick victims into entering sensitive information or connecting fraudulent cryptocurrency drainer scripts under the guise of purchasing Apple products. No known drainer kit signatures were publicly available at the time of analysis, but the site’s structure and SSL certificate suggest a high-fidelity replica targeting Apple users specifically.

This domain was flagged with 16/95 detections on VirusTotal, indicating a low initial detection rate despite active abuse. It was registered through Sav.com, LLC on April 01, 2026, and resolves to IP address 194.163.176.233. The domain is currently flagged by Google Safe Browsing under the “SOCIAL_ENGINEERING” classification and appears on 1 security blocklist. The SSL certificate, issued by Let’s Encrypt, adds superficial legitimacy, further enabling deception.

As of this report, macs-store.app remains active and unblocked by most AV vendors, posing a moderate but evolving risk to unsuspecting users. PhishDestroy confirms that InversionDNS has already blocked access to this domain. Users are strongly advised not to visit or interact with macs-store.app. Block this domain at network and endpoint levels, and avoid sharing any personal or financial data. Remaining risk includes continued operation, potential spread via phishing campaigns, and delayed detection due to low initial AV coverage.