login[.]workshopartistskin[.]com

This domain, login.workshopartistskin.com, poses a direct threat to users of the CS2 gaming platform by impersonating its login interface. The site presents a fraudulent 'Sign In' page, tricking victims into entering their account credentials, which are then captured by threat actors. Such credential harvesting can lead to account takeovers, unauthorized in-game purchases, or further exploitation through social engineering attacks targeting the victim's contacts or linked services. Analysis indicates the domain was registered on February 21, 2026, and is hosted on Cloudflare infrastructure (IP: 104.21.77.202, AS13335). The site is flagged by 15 out of 95 security vendors on VirusTotal, with detections including phishing and brand impersonation. Additionally, it appears on two security blocklists and is explicitly blocked by multiple threat intelligence feeds. The SSL certificate (WE1) and the use of Cloudflare suggest an attempt to lend legitimacy to the site while obscuring its true origin. If a user has visited login.workshopartistskin.com and entered credentials, immediate action is required. First, change the password for the CS2 account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) if not already active. Monitor the account for unauthorized activity, such as logins from unfamiliar locations or devices, and report any suspicious transactions to the platform's support team. Users should also scan their devices for malware, as phishing sites may distribute additional payloads. Finally, report the domain to relevant security teams or blocklist providers to aid in mitigating further risk.