cyon-ch[.]netlify[.]app

This domain, cyon-ch.netlify.app, is actively impersonating the brand cyon to deceive users and steal sensitive information. The threat actor is leveraging a convincing page title, 'Zahlungsinformation aktualisieren | cyon', to lure victims into believing they are interacting with a legitimate cyon service. This specific threat is designed to capture credentials, payment information, and other personal data, posing a significant risk to individuals and organizations who may fall victim to this deception.

Analysis indicates that the domain is flagged by 9 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection but also highlighting the potential for many users to remain unaware of the threat. The domain is registered through Netlify and resolves to the IP address 18.208.88.157, which is located in Germany and associated with AS16509 Amazon.com, Inc. The SSL certificate is issued by DigiCert Inc, providing a false sense of security. Additionally, the domain appears on one security blocklist, further emphasizing its malicious nature.

If users have visited cyon-ch.netlify.app, they should immediately change their passwords for all cyon-related accounts and any other services where the same credentials were used. It is also recommended to monitor financial statements and credit reports for any unauthorized activity. Users should report the incident to their organization's IT security team and consider enabling multi-factor authentication (MFA) to enhance account security.