Between July 30, 2026 and August 12, 2026, our team analyzed nine phishing incidents targeting organizations across five states — Kentucky, Texas, Georgia, Illinois, and Minnesota — with eight of those nine campaigns sharing infrastructure, delivery patterns, and page construction techniques consistent with a common operational framework. Impersonated brands drew from Microsoft's support and security surface — including Microsoft Support, Windows Defender, and the SmartScreen filter — with one campaign impersonating Greenvelope as a delivery pretext to harvest credentials for Outlook, Office 365, Yahoo, Gmail, and AOL accounts.
Eight of the nine pages were hosted on Azure Static Web Apps under the z13.web.core.windows[.]net subdomain, a legitimate Microsoft-owned hosting surface that supplies a microsoft[.]com parent domain, a Microsoft-signed TLS certificate, and a URL pattern that domain-reputation and certificate-authority controls will pass without friction; the ninth was hosted on an attacker-registered domain, secure.jorgbx[.]info, following a more conventional kit-hosting pattern.
Domains Reviewed
- viruswarning0812us4mjg8z.z13.web.core.windows[.]net/
- viruswarning0805ust7biyj.z13.web.core.windows[.]net/?utm_medium=paid&utm...
- viruswarning0805uszm9q8s.z13.web.core.windows[.]net/?utm_medium=paid&utm...
- viruswarning0805usoadw7d.z13.web.core.windows[.]net/ (2 variants)
- viruswarning0805usr8r05u.z13.web.core.windows[.]net/
- w048win04msn8n3641c009.z13.web.core.windows[.]net/index.html?utm_content... (2 variants)
- viruswarning0804usq5sz0f.z13.web.core.windows[.]net/ (2 variants)
- secure.jorgbx[.]info/dh/qr/
- w307win30msn7n3549c005.z13.web.core.windows[.]net/index.html?utm_source=...
A tech-support-scareware page impersonating Microsoft Support — including a reconstructed four-quadrant Windows logo, a full navigation bar replicating support.microsoft.com, and a page title of "Helpdesk Windows Support" — targeted a Georgia, Illinois, Kentucky, and Texas organization with a vishing lure designed to drive a phone call rather than harvest credentials directly. Layered over the background page, the HTML renders approximately twenty fixed-position popup cards cycling between "Security" and "System Error" labels, displaying repeated messages of "Password required for System32" and "Memory access violation at 0x88412," all positioned at z-index 8000 and above to fill the viewport and simulate a system in unrecoverable failure.
The cursor is set to `cursor: none` on the outermost container, a detail that compounds the impression of a locked or compromised machine by removing a basic affordance the victim would expect to control. The page is hosted on Azure Static Web Apps at viruswarning0812us4mjg8z[.]z13[.]web[.]core[.]windows[.]net, a legitimate Microsoft-owned domain that carries an implicit trust signal in browser URL bars and will pass most URL-reputation filters tuned to block typosquats or newly registered domains.
A credential-harvesting page impersonating the Greenvelope online invitation service targeted a Minnesota organization, using a fabricated "view your invitation" lure to prompt victims to authenticate with one of six email providers: Outlook, Office 365, Yahoo, Gmail, AOL, or a generic mail option. Activity was confined to July 31, 2026. Credentials are exfiltrated via a form POST to t3chboiguru.php on the attacker-controlled host secure.jorgbx[.]info, with the server returning a request ID that the kit then polls against check_status.php at two-second intervals, meaning a human operator reviews each submission in real time and manually approves or rejects the login before the victim's session advances.
If the operator approves the credentials, the page immediately launches a second-stage OTP capture: it displays a spinner telling the victim a one-time code was sent to their phone, collects the submitted token, and POSTs it to t3chboiguruotp.php, giving the operator live access to both the password and the MFA token within the same session window. A silent pixel — visitor_track.php rendered as a hidden image — fires on page load before any user interaction, giving the operator passive telemetry on who reached the page even if no credentials were ever submitted. Because the credential and OTP decisions are gated on operator approval rather than automated logic, the kit is built to support real-time account takeover, and any detection approach relying solely on login anomalies after credential submission will arrive after the operator has already acted.
Recommendations
- Configure proxy or DNS monitoring to alert on connections to `z13[.]web[.]core[.]windows[.]net` subdomains that match the naming pattern observed across this campaign — specifically, hostnames beginning with `viruswarning` or containing date-stamped strings followed by random alphanumeric suffixes — since the legitimate Azure Static Web Apps subdomain will pass reputation filters by design and requires pattern-based detection rather than domain blocking.
- Brief users on the specific visual fingerprint of these pages: a cursor that stops responding, twenty-plus overlapping error dialogs citing "Memory access violation at 0x88412" or "Password required for System32," and a phone number presented as the only way to recover the machine — because the entire conversion mechanism depends on the user believing the browser session is locked before they think to close the tab or call internal IT.
- Implement enterprise DNS or web-proxy logging that captures and retains UTM and ad-network referrer parameters — specifically `utm_source=fb`, `fbclid`, and Taboola referral strings observed in this campaign — so that lures delivered via paid social and native advertising (which bypass email gateways entirely) produce an auditable network event that analysts can triage.
- Block or alert on calls to the attacker-controlled domain `jorgbx[.]info` and its `t3chboiguru.php` / `check_status.php` / `t3chboiguruotp.php` endpoints at the proxy and DNS layers; unlike the Azure-hosted vishing pages, this is attacker-owned infrastructure and there is no legitimate use case that would produce traffic to it.
- For the real-time OTP-harvesting technique observed in Incident 8 — where the kit polls operator approval before advancing the session — configure conditional access to enforce session re-authentication or step-up verification on any high-privilege action taken within minutes of initial sign-in, since by the time a login anomaly fires, the operator has already had time to act on the submitted credential and OTP.
- Establish a process for employees to report unexpected browser states (frozen pointer, full-screen error overlays, unsolicited "call Microsoft" prompts) directly to the SOC via a non-browser channel such as a posted phone number or a mobile app, targeting the exact social-engineering moment these pages exploit — a user who cannot dismiss the overlay but has not yet called the attacker number is still recoverable.
- Deploy call-analytics or SIEM correlation rules to flag repeated outbound calls from organizational phone lines or soft-phone clients to toll-free numbers that appear in threat-intelligence feeds, as every incident in this campaign terminates in a vishing call to a static number — phone numbers that, unlike infrastructure, change slowly and represent a durable detection surface across the campaign's full lifespan.
Learn how PhishID can help protect your district from cutting-edge threats like these! Schedule a Demo
