moonpaydesktop[.]com

PhishDestroy identifies a newly registered domain, moonpaydesktop.com, actively propagating a sophisticated PayPal-themed phishing campaign designed to harvest payment credentials. The site mimics the official MoonPay desktop application interface, tricking users into entering sensitive financial data under the guise of a software update or security verification. Threat actors leverage Let's Encrypt SSL certificates to enhance credibility, while the domain resolves to IP 216.150.1.1—a server linked to previous malicious infrastructure. Early-stage analysis reveals this operation is still under investigation, with no antivirus signatures yet flagging the threat vector.

This domain was flagged through multiple threat intelligence channels, revealing alarming technical indicators. VirusTotal currently shows 0 out of 95 scanning engines detecting the malicious payload, indicating a fresh or stealthily configured threat. Registrant details trace back to NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for hosting transient domains tied to fraudulent activities. The domain itself was created on April 27, 2026—merely days ago—further suggesting an opportunistic campaign leveraging newly minted domains to evade detection. At present, no public blocklists include this domain, amplifying the risk to unsuspecting users.

If you’ve accessed moonpaydesktop.com, immediately cease any input of credentials or financial details. Disconnect from the site and run a full antivirus scan. Monitor accounts linked to any submitted information and consider enabling two-factor authentication where possible. Report the domain to your IT security team or file a complaint with your local cybercrime unit. Avoid re-accessing the domain, as it remains active and may deploy additional malware. Stay vigilant for phishing attempts using similar lures, especially those impersonating payment processors or software updates.