hragents[.]nadqa[.]nadsoft[.]co

This domain, hragents.nadqa.nadsoft.co, is actively engaged in credential harvesting phishing operations targeting corporate users. Analysis indicates the infrastructure is designed to impersonate human resources or employee self-service portals, likely distributing fake login pages to capture usernames, passwords, and multi-factor authentication tokens. The domain employs subdomain chaining (hragents.nadqa) to create a false sense of legitimacy, a common tactic in spear-phishing campaigns against enterprise environments. Infrastructure analysis reveals the domain was registered on March 26, 2026, with no prior legitimate history. It appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, including detections for phishing, malicious URL, and social engineering. The registrar details and hosting provider remain consistent with known phishing infrastructure, though no direct attribution to specific threat actors has been established at this time. Users who have visited hragents.nadqa.nadsoft.co or entered credentials on any page hosted under this domain should immediately revoke active sessions, reset passwords for all accounts accessed from the same device, and enable multi-factor authentication if not already in use. Network administrators are advised to block the full domain and all subdomains at the perimeter, monitor for signs of credential abuse, and review logs for connections to this infrastructure. Any devices used to access the site should be scanned for malware, as phishing pages often deploy secondary payloads.