jetbrains-apps-group[.]gitlab[.]io

This domain, jetbrains-apps-group.gitlab.io, is confirmed to host a credential harvesting phishing site targeting software developers. The infrastructure mimics legitimate JetBrains services, a provider of integrated development environments, to deceive users into submitting login credentials. Analysis indicates the site employs social engineering tactics, presenting a cloned authentication interface to capture sensitive account information, which may lead to unauthorized access to development environments, source code repositories, or corporate networks. Infrastructure analysis reveals the domain is currently active and resolves to the IP address 35.185.44.232. It utilizes a GlobalSign nv-sa SSL certificate, which may lend an appearance of legitimacy to unsuspecting users. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flagged this domain as malicious, suggesting the threat is either newly deployed or employs evasion techniques to avoid widespread detection. The domain is hosted on a platform that allows rapid deployment of static sites, enabling threat actors to quickly establish and dismantle phishing infrastructure with minimal traceability. Users who have visited jetbrains-apps-group.gitlab.io or entered credentials on the site should immediately revoke any submitted passwords and enable multi-factor authentication on associated accounts. System administrators are advised to block the domain and its resolving IP address (35.185.44.232) at the network perimeter. Affected users should monitor accounts for unauthorized activity and consider rotating credentials for any services where the same password was reused. Organizations should conduct internal reviews to assess potential exposure, particularly if the compromised credentials had elevated permissions or access to sensitive repositories.