started-desktop-en[.]wixstudio[.]com

PhishDestroy identifies started-desktop-en.wixstudio.com as a Microsoft 365 credential phishing domain active in the wild. This domain mimics Microsoft’s desktop login portal to harvest corporate and personal Microsoft 365 credentials, posing a direct risk to enterprise and individual accounts if credentials are entered. The page is hosted on WixStudio’s infrastructure, leveraging a legitimate service to evade immediate detection while delivering a convincing fake login form. This domain exhibits several concerning technical indicators. VirusTotal currently shows 4/95 detections, indicating it has not yet been widely flagged by antivirus engines despite its malicious intent. The domain resolves to IP address 34.144.206.118, which hosts multiple suspicious domains and is associated with low-reputation hosting providers. The SSL certificate is issued by Let’s Encrypt, a trusted authority, which may help the phishing page appear legitimate to users checking for HTTPS. WixStudio’s infrastructure, while generally reputable, has been repeatedly abused by threat actors to host phishing content, complicating takedown efforts due to the platform’s legitimate reputation. Users who have visited this domain should immediately check their Microsoft 365 accounts for unauthorized access, enable multi-factor authentication (MFA), and revoke any unfamiliar sessions or linked applications. If credentials were entered, change the password immediately and scan for malware using a trusted endpoint security tool. Organizations should report the domain to their security teams and block it at the network perimeter. Avoid interacting with this domain or any links associated with it, and report it to PhishDestroy or relevant abuse channels to aid in broader threat intelligence sharing.