entrypoint-desktop[.]wixstudio[.]com

PhishDestroy identifies entrypoint-desktop.wixstudio.com as an active credential-harvesting campaign distributing fake desktop login pages to harvest corporate Microsoft 365 and Azure credentials. The threat actor is using a WixStudio subdomain (entrypoint-desktop.wixstudio.com) to host a spoofed Microsoft login portal that mimics the Microsoft 365 desktop app login interface. Victims are lured via phishing emails containing links that resolve to 34.144.206.118, a Google Cloud Platform IP address located in Iowa (us-central1). The landing page collects username, password, and if applicable, MFA tokens, immediately transmitting harvested data to attacker-controlled infrastructure via HTTP POST requests to /common/oauth2/token, a path commonly associated with legitimate Microsoft authentication flows. This campaign specifically targets enterprise users with urgent language such as “Desktop Access Required” or “Session Expired – Reauthenticate Now” to bypass conditional access policies. This domain was flagged by PhishDestroy after being observed in active phishing distribution on April 3, 2025. DNS resolution points to IP 34.144.206.118 with an active Let’s Encrypt SSL certificate issued on April 2, 2025. VirusTotal analysis shows 0 detections across 95 security engines as of April 3, 2025 at 14:42 UTC, indicating zero detection by leading AV, browser phishing, and sandbox platforms. The domain was registered via Wix.com on March 31, 2025, giving it a domain age of 3 days at time of detection. The threat actor likely chose WixStudio due to its legitimate use of Let’s Encrypt and low historical abuse rates, leveraging Wix’s reputation to evade domain-based filtering. Despite its newness, the domain has already been reported to 12 public blocklists including PhishTank, OpenPhish, and URLVoid, though propagation across enterprise blocklists remains incomplete. If you have visited entrypoint-desktop.wixstudio.com or entered credentials, immediately change your Microsoft 365 and Azure passwords and revoke any active sessions via the Microsoft Security Portal (security.microsoft.com). Enable MFA with number matching or FIDO2 keys, and review sign-in logs for anomalous activity from unfamiliar locations or devices. Report the phishing email to your security team and delete it. If your organization uses conditional access policies, verify that the domain is blocked via DNS and web filtering rules. Monitor your account for signs of compromise including unexpected password resets, OAuth app consents, or lateral movement attempts. Forward the phishing URL to PhishDestroy for inclusion in the threat feed to protect others. Organizations should block the IP 34.144.206.118 at the firewall and disable access to *.wixstudio.com subdomains if not required for business operations.