truvoincore[.]com

This domain, truvoincore.com, is flagged as a credential theft operation designed to harvest user login details through deceptive private browsing interfaces. The site mimics legitimate privacy tools, presenting a "New Private Tab" page title to lure victims into entering sensitive information, which is then transmitted to attacker-controlled servers. Analysis indicates this is not a generic phishing attempt but a targeted effort to steal account credentials, potentially for financial fraud or identity theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 04, 2026, through Spaceship, Inc., a registrar often exploited for short-lived malicious domains. It resolves to the IP address 37.49.229.75 and is detected by 14 out of 95 security vendors on VirusTotal. Additional red flags include its presence in four AlienVault OTX threat intelligence pulses and a 0/100 trust score from Gridinsoft, confirming its classification as a high-risk entity. The use of Let's Encrypt SSL certificates further masks its malicious intent by appearing legitimate to unsuspecting users. If you visited truvoincore.com or entered any information on the site, immediate action is required to mitigate potential damage. First, terminate any active sessions and disconnect from the network to prevent further data exfiltration. Change passwords for all accounts accessed or created during the session, prioritizing email, financial, and social media platforms. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity and report any suspicious transactions to the relevant service providers. Users should also scan their devices for malware, as credential theft sites often deploy secondary payloads to maintain persistence.