hub-suitesapp[.]wixstudio[.]com

PhishDestroy identifies an active credential harvesting campaign targeting Microsoft 365 users via hub-suitesapp.wixstudio.com, a domain hosted on Wix's platform. This domain resolves to IP address 34.144.206.118 and currently shows zero detections out of 95 VirusTotal scans. The threat actor leveraged a legitimate Let’s Encrypt SSL certificate to appear trustworthy, while the domain was only recently created and remains unblocked across major threat intelligence feeds at this time. Users who accessed this domain should immediately change any entered credentials and enable multi-factor authentication on their Microsoft 365 accounts. Review account login activity for anomalies, scan local devices for malware, and report the activity to your security team for further investigation and blocklisting.