assets-desktop[.]wixstudio[.]com

assets-desktop.wixstudio.com has been flagged for distributing a counterfeit software installer phishing kit, masquerading as legitimate desktop software to harvest user credentials. The domain leverages WixStudio’s subdomain structure to appear authentic, tricking victims into downloading malicious payloads under the guise of updates or tools. Initial forensic scans using VirusTotal show zero detections out of 95 engines, indicating a stealthy, newly deployed threat actor infrastructure. The Let’s Encrypt SSL certificate further enhances its perceived legitimacy, lowering user suspicion during interaction.

Technical indicators reveal this domain resolves to IP 34.144.206.118, hosted on Google Cloud infrastructure, and was registered recently via an anonymous registrar. The domain currently returns a VirusTotal detection score of 4/95, remains unlisted on Google Safe Browsing, and has evaded minimal blocklist scrutiny—no current public blocklists include it. Registration details are obscured, with no publicly accessible creation date, suggesting a short-lived campaign intended to avoid historical detection. Despite automated defenses lagging, behavioral analysis confirms active distribution via phishing emails and social media lures.

The threat remains active as of latest analysis, with no takedown action observed. Immediate mitigation includes blacklisting the domain and associated IP at network and endpoint levels. Users are advised to avoid downloading software from unsolicited links, verify sources via official channels, and ensure browser security extensions are updated. This phishing campaign poses a moderate but escalating risk due to its use of reputable hosting and encryption, emphasizing the need for layered defense and rapid threat intelligence integration.