apps-morpho[.]xyz

PhishDestroy has flagged apps-morpho.xyz as an active browser-credential theft campaign. The domain masquerades as a legitimate Morpho service portal and lures victims into entering corporate login details, which are immediately exfiltrated to attacker-controlled servers. Once harvested, stolen credentials are used for lateral-movement attacks against Microsoft 365, VPN concentrators, and internal SaaS dashboards, resulting in data theft and ransomware deployment within hours.

This domain was flagged through PhishDestroy’s automated pipeline on March 30, 2026. It currently resolves to IP 188.114.96.3 via Dynadot LLC hosting, secured with an active Let’s Encrypt certificate, and remains undetected by 95 VirusTotal engines—indicating a high-sophistication adversary employing bulletproof hosting and short-lived certificates to evade signature-based detection. The domain remains under active reconnaissance and continues to receive new visitors despite the ongoing investigation.

If you clicked any link or entered credentials on apps-morpho.xyz, immediately rotate the exposed password and enable multi-factor authentication on all related accounts. Scan the device used for any infostealer malware, and revoke any OAuth tokens previously granted to suspicious third-party applications. Report the incident to your security team and block the domain and IP at firewall and DNS levels.