endesktop-live[.]wixstudio[.]com

PhishDestroy identifies enddesktop-live.wixstudio.com as an active crypto drainer site masquerading as the legitimate End Desktop application. This domain was flagged during a routine scan targeting suspicious subdomains hosted on wixstudio.com, a platform frequently abused for quick-deploy phishing pages. The site lures victims with fake download links for an 'End Desktop' cryptocurrency management tool, which instead injects malicious JavaScript designed to drain connected wallets by intercepting and approving unauthorized transactions. Initial telemetry shows multiple user reports of unauthorized fund transfers following visits to the page, indicating the campaign is operational and actively targeting crypto users. This domain resolves to IP 34.144.206.118 and uses a valid Let’s Encrypt SSL certificate to appear legitimate. VirusTotal currently shows 0 detections across 95 engines, leaving it undetected by most antivirus systems. The subdomain enddesktop-live.wixstudio.com is hosted on Wix’s Studio platform, which allows rapid deployment with minimal oversight. WixStudio is a legitimate service, but threat actors frequently exploit its flexibility to host spoofed pages. Creation date and registrar data are obscured due to Wix’s privacy protections, but the domain was observed in active phishing feeds on April 12, 2024. It has not yet appeared on major threat intelligence blocklists, increasing the risk of exposure before detection. If you visited enddesktop-live.wixstudio.com, disconnect any cryptocurrency wallets immediately and revoke any unauthorized transaction approvals through your wallet’s interface. Do not approve any further transactions from connected apps. Run a full system scan using updated antivirus software, and consider using a hardware wallet for future transactions to reduce exposure. Report the domain to your wallet provider and block it at the network level. Monitor financial accounts closely for unauthorized activity. Share this advisory with others who may have used the site to prevent further victimization.