microsoft-autofill-login-not-working[.]pages[.]dev

PhishDestroy identifies microsoft-autofill-login-not-working.pages.dev as an active brand impersonation threat mimicking Microsoft's login interface. This fraudulent domain is engineered to deceive users into entering sensitive credentials under the guise of resolving a fictitious 'autofill login' issue. The page leverages Microsoft's branding to lower user suspicion, a tactic commonly associated with credential harvesting or downstream malware deployment. No evidence suggests the deployment of a crypto drainer kit at this time, but the domain's structure aligns with known phishing frameworks that extract session cookies or credentials for account takeover. This domain was flagged by 8 of 95 VirusTotal security vendors and is registered through Cloudflare, Inc. It resolves to IP address 188.114.96.3, which hosts multiple suspicious domains. The domain operates under a Google Trust Services SSL certificate, enhancing its perceived legitimacy. While the exact creation date remains unverified in open-source intelligence, the domain's recent activity and low VT detection ratio at inception suggest a rapidly evolving threat profile. This domain has not yet been added to major blocklists such as Google Safe Browsing (GSB), further increasing its potential reach and dwell time. As of the latest assessment, this domain remains active with an elevated risk rating. PhishDestroy has flagged this domain for immediate takedown review and is coordinating with hosting provider Cloudflare to suspend services. Users are advised to avoid accessing this domain and to report any interactions via PhishDestroy's verification portal. The residual risk remains moderate due to the domain's current lack of widespread blocklisting and the persistent nature of brand impersonation campaigns. Continuous monitoring is underway to detect any shifts in infrastructure or payload delivery mechanisms.