mitasmsklogind[.]webflow[.]io

Mitasmsklogind.webflow.io is an active Microsoft credential phishing site designed to trick visitors into surrendering their Microsoft account username and password. When a user enters their credentials on the page, the information is immediately sent to the attacker instead of Microsoft, which can lead to account takeover, data theft, and follow-on phishing attacks sent to the victim’s contacts. Web browsers, email providers, and security vendors use blocklists and AI models to detect the domain; currently 19 out of 95 engines flag it, but the page remains live and accessible. This domain was created in early 2024 and is registered through a reputable provider. VirusTotal confirms 19/95 security vendors detect the threat, and the site is served from IP address 104.18.36.248 using a Google Trust Services SSL certificate. The page is also listed on one public blocklist, indicating cross-vendor consensus that the site is malicious. Despite its recent creation, the campaign is active and evolving, so up-to-date detection lags are common. If you visited mitasmsklogind.webflow.io, assume your Microsoft credentials were compromised. Change your Microsoft password immediately using a known-good device and network, then enable multi-factor authentication. Scan the device you used with a reputable antivirus tool and review recent sign-in activity at account.microsoft.com. Report any suspicious messages sent from your account to your security team or Microsoft’s Report Abuse portal. To prevent future exposure, avoid clicking links in unexpected emails and use a password manager that highlights known phishing domains.