build-desktop[.]pages[.]dev

Domain build-desktop.pages.dev has been identified as an active credential theft endpoint hosting a crypto drainer under the guise of a desktop application builder. The threat is currently classified with a risk level of 'under_investigation' and is flagged as a live campaign targeting unsuspecting users. PhishDestroy’s analysis confirms the domain is weaponized to harvest sensitive credentials under the pretense of providing legitimate desktop software tools.

This domain resolves to IP 172.66.44.92 and is registered through Cloudflare, Inc. Despite zero detections on VirusTotal (6/95 vendors as of latest scan), the infrastructure leverages a Google Trust Services SSL certificate to enhance credibility. The use of Cloudflare’s infrastructure and a Google-issued certificate suggests an attempt to evade traditional detection mechanisms by exploiting the trust associated with reputable services. The combination of low detection rates and sophisticated infrastructure underscores the deceptive nature of this campaign.

As of this report, the campaign remains active and is actively distributing malicious payloads. Users are strongly advised to avoid interacting with build-desktop.pages.dev or any associated links. Organizations should implement network-level blocking for the domain and IP 172.66.44.92. Immediate actions include scanning endpoints for signs of compromise, updating threat intelligence feeds with this IOC, and conducting user awareness training to prevent credential theft. Further investigation is ongoing to identify additional infrastructure and payload details.