connect-live-desktop-app[.]pages[.]dev

PhishDestroy identifies connect-live-desktop-app.pages.dev as a live crypto drainer posing as a legitimate remote desktop application. This domain mimics official remote desktop tools like Chrome Remote Desktop or Windows Remote Desktop to trick users into downloading malicious installers. The threat targets cryptocurrency holders specifically by replacing clipboard addresses with attacker-controlled wallets during transactions. This domain was flagged for crypto drainer activity and is currently under active investigation. It resolves to IP address 188.114.97.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate. VirusTotal currently shows 10/95 detections on this domain, indicating it may be newly deployed or employing advanced evasion techniques against detection engines. The domain’s Pages.dev subdomain structure suggests it was created recently to exploit Cloudflare’s free hosting for malicious campaigns. Users who visited connect-live-desktop-app.pages.dev should immediately check their browser history for downloads, scan their devices with updated antivirus software, and verify any downloaded executables using VirusTotal. If cryptocurrency transactions were attempted during the visit, check wallet addresses against known fraudulent ledgers and revoke any clipboard permission requests made by suspicious applications. Avoid interacting with any prompts requesting remote access or wallet connections from this domain. Report the domain to your antivirus provider and local cybercrime units for further analysis.