itau-landing[.]vercel[.]app

This domain, itau-landing.vercel.app, operates as a credential theft phishing site targeting customers of Banco Itaú, a major Brazilian financial institution. The page mimics the bank’s official branding, including the title "Banco Itaú | Feito com você," to deceive users into entering sensitive login credentials, such as account numbers, passwords, and two-factor authentication codes. Analysis indicates the infrastructure is designed to harvest and exfiltrate stolen data to attacker-controlled servers, likely for immediate financial fraud or account takeover. Infrastructure analysis reveals the domain is hosted on Vercel Inc.’s platform and resolves to the IP address 64.29.17.67, located within Amazon.com, Inc.’s AS16509 network in the United States. The domain is flagged by 17 out of 95 security vendors on VirusTotal, including detections for phishing and malicious activity. It appears on two security blocklists and is actively blocked by at least two threat intelligence feeds. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. Google Safe Browsing has also marked this domain as phishing. Users who have visited itau-landing.vercel.app or entered credentials on the site should immediately take corrective action. First, change all passwords associated with Banco Itaú accounts, including any linked email addresses or secondary authentication methods. Enable multi-factor authentication if not already active. Monitor bank statements and transaction histories for unauthorized activity, and report any suspicious transactions to the financial institution. If personal or financial data was entered, consider placing a fraud alert or credit freeze with relevant credit bureaus to prevent identity theft. Avoid interacting with any communications claiming to be from Banco Itaú that reference this domain, as they may be follow-up phishing attempts.