secure-device-auth-office-com[.]dporozok[.]workers[.]dev

PhishDestroy identifies the domain secure-device-auth-office-com.dporozok.workers.dev as an active credential theft campaign impersonating Microsoft Office authentication portals. The infrastructure leverages a multi-layered obfuscation technique, embedding the phishing payload within a Cloudflare Workers subdomain to evade traditional detection mechanisms. The threat actor’s objective is to harvest Office 365 credentials through a spoofed login interface, enabling further account takeovers and lateral movement within enterprise environments. This domain resolves to the IP address 188.114.96.3 and is registered through Cloudflare, Inc., leveraging a Let’s Encrypt SSL certificate to enhance legitimacy. The domain was flagged by 11 out of 95 security vendors on VirusTotal and is currently blocked by OpenPhish. Security blocklist status indicates prior exposure, with this domain appearing on at least one global blocklist. The use of a Cloudflare Workers subdomain (workers.dev) represents a deliberate tactic to obscure the true origin and infrastructure of the campaign. The campaign remains active as of the latest assessment, with no evidence of takedown at the time of writing. Given the elevated risk posed by credential theft, immediate blocking of the domain and associated IP is recommended. Users should verify any unsolicited login prompts via official Microsoft channels and enable multi-factor authentication (MFA) to mitigate potential compromise. The remaining risk is classified as elevated due to the domain’s ability to bypass initial scrutiny through legitimate hosting services.