unionctb[.]com

This domain, unionctb.com, is identified as a credential theft operation designed to harvest login credentials from users under the guise of financial services or banking platforms. Visitors to this site are presented with fraudulent login interfaces that mimic legitimate financial institutions, tricking them into entering sensitive information such as usernames, passwords, and multi-factor authentication codes. The stolen credentials are then exploited for unauthorized account access, financial fraud, or sold on underground markets. The threat extends beyond immediate financial loss, as compromised credentials can be leveraged for further attacks, including identity theft and targeted spear-phishing campaigns. Analysis indicates that unionctb.com was registered on May 26, 2026, through TuringSign Inc. d/b/a Cosmotown, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 66.85.46.67, which has been linked to other malicious activities in recent threat intelligence reports. Security vendors on VirusTotal have flagged this domain as malicious, with 9 out of 95 engines detecting it as a threat. Additionally, the domain is blocked by PhishDestroy and appears on at least one security blocklist, further corroborating its malicious nature. The SSL certificate, issued by Let's Encrypt (R12), is a common tactic used by threat actors to lend a false sense of legitimacy to phishing sites. If you or someone in your organization visited unionctb.com, immediate action is required to mitigate potential damage. First, disconnect the affected device from the network to prevent further data exfiltration. Reset all credentials entered on the site, prioritizing financial accounts, email, and any platforms where password reuse may have occurred. Enable multi-factor authentication on all critical accounts to add an additional layer of security. Monitor financial statements and credit reports for unauthorized transactions or signs of identity theft. If corporate credentials were exposed, notify your organization's security team to initiate an incident response protocol. Finally, conduct a full antivirus scan on the device to detect and remove any malware that may have been downloaded during the visit.