texabaycu[.]com

This domain, texabaycu.com, is identified as a credential harvesting phishing site targeting users of a legitimate credit union. The fraudulent page mimics the branding and interface of TEXASBAY CREDIT UNION, presenting a login portal designed to capture sensitive authentication credentials, including usernames, passwords, and potentially multi-factor authentication codes. The site employs social engineering tactics, such as urgency-inducing language and cloned visual elements, to deceive visitors into submitting their financial account details. Given the elevated risk level, this campaign likely aims to facilitate unauthorized account access, fund transfers, or identity theft. Analysis indicates the domain was registered on August 20, 2024, through OwnRegistrar, Inc., a registrar frequently associated with short-lived phishing infrastructure. The domain resolves to the IP address 192.3.190.186, hosted on AS36352 (HostPapa) in the United States. Security vendor detections on VirusTotal report 12 out of 95 engines flagging the domain as malicious, while it appears on one additional security blocklist. The SSL certificate, issued by Let's Encrypt (R13), provides HTTPS encryption, a common tactic to lend false legitimacy to phishing pages. Infrastructure patterns, including the recent creation date and low detection count, suggest an attempt to evade automated defenses before widespread blocking occurs. Users who visited texabaycu.com or entered credentials on the site should immediately revoke any submitted information. Affected individuals should log into their legitimate financial accounts through verified channels to change passwords and review recent transactions for unauthorized activity. Multi-factor authentication should be enabled if not already active, and financial institutions should be notified of potential exposure. Security teams are advised to block the domain and associated IP (192.3.190.186) at the network level to prevent further access. Monitoring for follow-up phishing attempts or fraudulent communications referencing this incident is recommended.