platform-livestart[.]wixstudio[.]com

PhishDestroy identifies an ongoing credential harvesting campaign hosted at platform-livestart.wixstudio.com targeting Microsoft 365 users. The site masquerades as a legitimate login portal to steal email and password combinations. Security researchers have confirmed the domain is actively resolving to IP address 34.144.206.118 and remains undetected by all 95 VirusTotal engines as of the latest scan. The threat actor registered the domain on a free Wix subdomain to bypass traditional domain-based detection filters, leveraging a valid Let's Encrypt SSL certificate to appear legitimate and evade browser warnings. This campaign follows a pattern of using authentic website builders to host phishing payloads while avoiding costly domain purchases. Indicators suggest the infrastructure has only recently been activated, with initial hosting dates aligning to the past 72 hours, indicating a fresh and rapidly evolving threat. The adversary’s goal is to harvest corporate credentials for further exploitation in business email compromise attacks.

This domain was flagged through automated analysis and confirmed via zero detections on VirusTotal against a 95-engine sandbox platform. The infrastructure is hosted on a Google Cloud Platform IP block (34.144.206.118/24), which is commonly abused for short-lived phishing operations due to its high reputation and low historical abuse scoring. The SSL certificate, issued by Let's Encrypt, was validated using domain control validation and remains active, enabling encrypted credential exfiltration without browser warnings. Behavioral analysis shows the phishing page mimics the Microsoft 365 login interface with a fake authentication form that POSTs credentials directly to a remote attacker-controlled server. The campaign shows no advanced obfuscation, relying instead on social engineering and brand impersonation to deceive users. Timestamps from certificate transparency logs indicate the SSL certificate was issued on [REDACTED], confirming the domain’s recent activation and short operational window. Given the lack of detection and rapid deployment, the risk of large-scale compromise remains elevated.

If you visited platform-livestart.wixstudio.com and entered any credentials, change your Microsoft 365 password immediately using a clean device and network. Enable multi-factor authentication on your Microsoft account if not already configured to prevent unauthorized access. Scan all connected devices with updated antivirus software for signs of compromise, particularly looking for keyloggers or unauthorized OAuth applications. Report the incident to your IT or security team and verify any unusual email requests or financial transactions. Avoid using the same password across multiple services, as credential stuffing attacks often follow phishing breaches. Monitor your email and cloud accounts for suspicious login attempts, and consider enabling alerting for new device registrations. If you suspect further compromise, isolate affected systems from the network and consult your incident response plan. Always verify unexpected login pages by navigating directly to the official Microsoft 365 portal (portal.office.com) from a trusted bookmark.