barclays-grads[.]twineapp[.]com

This domain, barclays-grads.twineapp.com, operates as a credential theft platform impersonating Barclays, a major financial institution. The site presents a fraudulent login interface designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. Analysis indicates the threat actor leverages the Barclays brand to exploit trust, targeting customers under the guise of graduate program services or account verification processes. The domain’s infrastructure and page design closely mimic legitimate Barclays portals, increasing the likelihood of successful deception. Infrastructure analysis reveals the domain was registered on March 07, 2014, through 123-Reg Limited, though its malicious use appears recent. It resolves to IP address 54.77.139.224, hosted on Amazon Web Services (AS16509) with an Amazon RSA 2048 M02 SSL certificate. The domain is flagged by 6 out of 95 security vendors on VirusTotal and appears on 2 security blocklists, including PhishDestroy and Phishunt. Despite its long registration history, the domain’s current activity aligns with credential harvesting campaigns, with no legitimate use case observed. Users who have visited barclays-grads.twineapp.com or entered credentials on the site should immediately revoke any submitted information by resetting passwords for Barclays accounts and any other services where identical credentials were reused. Enable multi-factor authentication on all financial and sensitive accounts to mitigate unauthorized access. Monitor account statements for unauthorized transactions and report suspicious activity to the legitimate financial institution. If personal or financial data was exposed, consider placing a fraud alert on credit files to prevent further exploitation.