Phish Wire - Aug 26, 2026

Between August 13 and August 26, 2026, our team analyzed four distinct phishing campaigns targeting organizations across Arizona, Kentucky, Florida, and Texas, each operating against a single organization with activity concentrated within a single day, a pattern more consistent with targeted delivery than broad-spectrum spraying. Across the incidents, attackers employed three credential-capture mechanisms: form-POST submissions to attacker-controlled endpoints, adversary-in-the-middle reverse-proxy relay intercepting credentials and session tokens before forwarding traffic to legitimate infrastructure, and a deliberate double-submit harvesting loop that simulates an authentication failure on first entry to coax credential re-submission followed immediately by a second-stage OTP collection overlay.

Impersonated brands and services identified from on-page evidence include Microsoft Windows and its associated SmartScreen and Firewall components, Netflix, Adobe Cloud, and a multi-provider identity picker referencing Outlook, Office 365, Gmail, Yahoo, and AOL alongside embedded CSS referencing Texthelp educational technology products including ReadWrite, EquatIO, and Browseалoud. Infrastructure across the four campaigns divided between attacker-registered or compromised domains — campflexevite[.]com, floorheatingonline[.]com, and check.jeuxf[.]vu — and a page delivered from Microsoft's own Azure Static Web Apps platform under the z13.web[.]core.windows[.]net subdomain, which carries a valid TLS certificate issued by a widely trusted provider.

The Azure-hosted scareware case is the period's most tactically distinct incident: because the conversion goal is a phone call rather than a form submission or token capture, the entire detection surface collapses to a single user behavior, and any endpoint or network control oriented around data exfiltration events will produce no signal at all. Taken together, the four campaigns reflect a deliberate mix of infrastructure strategies — abusing trusted cloud platforms for implicit reputation, compromising unrelated legitimate domains to bypass domain-age signals, and hosting on attacker-registered infrastructure — suggesting operators are actively selecting hosting choices to work around specific categories of detection rather than defaulting to a single infrastructure pattern.

Domains Reviewed

• campflexevite[.]com/jimmyoo/paperlesscountdown/
• viruswarning0824us92jiax.z13.web.core.windows[.]net/
• floorheatingonline[.]com/
• check.jeuxf[.]vu/rsvp/ (3 variants)

A credential-harvesting page styled as a "Paperless Countdown" event invitation targeted an Arizona organization, using a blurred background image and a semi-transparent overlay box to frame what the HTML structures as a multi-button credential or identity-selection prompt. Activity was confined to August 26, 2026, with a single observed event suggesting a narrow, targeted delivery rather than a broad spray. The buried CSS variable block references Texthelp product themes — ReadWrite, EquatIO, Browseалoud, ReachDeck, SpeechStream, FluencyTutor — which are accessibility tools common in K-12 and higher education environments, pointing to a likely education-sector target in Arizona and suggesting the kit may have been built or repurposed from a page impersonating an educational technology provider. The blurred background with the campflexevite[.]com domain and the /jimmyoo/paperlesscountdown/ path indicate a compromised or attacker-registered host used as a subdirectory staging ground, meaning endpoint telemetry should treat the full path as the indicator rather than the domain alone, since the host may be serving unrelated legitimate content from its root.

A tech-support scareware page impersonating Microsoft Windows Helpdesk targeted a Kentucky organization, presenting a fabricated support portal dressed in Microsoft's Segoe UI typeface, four-square logo, and Windows-blue color palette to establish surface-level brand legitimacy before deploying its payload. Activity was confined to August 24, 2026. The scareware layer itself consists of twenty-plus absolutely-positioned "System Error" and "Security" toast notifications hardcoded across viewport-relative coordinates, all displaying either "Memory access violation at 0x88412" or "Password required for System32," combined with a hidden cursor (cursor: none on the root element) and a synthetic mouse-pointer SVG pinned at fixed coordinates — a combination designed to make the page feel like a locked system the user cannot interact with normally.

A credential-harvesting page impersonating Netflix targeted a Florida organization, serving a pixel-perfect clone of the Netflix login flow from the domain floorheatingonline[.]com, a site whose legitimate purpose has no connection to media streaming. Activity was confined to August 21, 2026. The page loads authentic Netflix JavaScript bundles and CSS from assets.nflxext[.]com, but every resource request is routed through a local proxy path at floorheatingonline[.]com/jedu6m/dzljkmyz/nd5g2pbp/ that base64-encodes the true destination URL as the final path segment, a pattern consistent with a reverse-proxy or adversary-in-the-middle kit intercepting credentials and session tokens before relaying traffic to the real Netflix infrastructure.

A Texas organization encountered a multi-stage credential-harvesting campaign built around a fake Adobe Cloud document-share lure, presenting victims with a provider-selection page offering sign-in buttons for Outlook, AOL, Office 365, Yahoo, Gmail, and a generic "Other Mail" option. Three detections occurred on August 17, 2026. Credentials are captured through a jQuery AJAX POST to next.php on the attacker-controlled host check.jeuxf[.]vu, with the kit deliberately requiring two submission attempts before advancing the session — the first submission returns a simulated "Invalid Credentials" error to coax re-entry of credentials, and only on the second submission does the kit POST the email, password, and identified provider label, then transition to a second-stage OTP overlay that POSTs the entered code to Analysis405/otp_process.php, meaning the kit is positioned to harvest both the primary password and any one-time passcode the victim receives.

Recommendations

• Flag and quarantine email-delivered lures containing unsolicited document-share notifications (particularly Adobe Cloud and event-invitation themes) where the sending domain has no prior organizational relationship — the jeuxf[.]vu and campflexevite[.]com campaigns both relied on cold-contact pretexts that a first-contact sender policy would have surface-flagged before delivery.
• Monitor Azure Static Web Apps subdomains (*.web.core.windows[.]net) for pages presenting Windows-branded UI elements, fake system-error toast notifications, or embedded phone numbers styled as support contacts — the z13.web.core.windows[.]net campaign demonstrates that Microsoft-signed TLS and CDN delivery will pass URL-reputation checks, so detection must shift to page-content heuristics rather than domain signals.
• Deploy proxy or DNS inspection rules that alert on requests where a non-platform domain (e.g., floorheatingonline[.]com) is observed loading resources from platform CDNs (e.g., assets.nflxext[.]com) — this base64-proxied relay pattern is the fingerprint of an adversary-in-the-middle kit and will not be caught by certificate validity or domain-reputation checks alone.
• Configure web-filtering and SIEM alerting to treat full URL paths — not just root domains — as indicators when a compromised legitimate host is involved; the campflexevite[.]com campaign staged its kit under /jimmyoo/paperlesscountdown/, meaning a domain-only block would suppress legitimate root content while missing the malicious subdirectory.
• Tune authentication anomaly detection to flag session tokens that arrive from non-originating IP addresses shortly after a login event, specifically targeting the AiTM relay pattern observed with floorheatingonline[.]com, where valid session cookies are intercepted and replayed before the victim recognizes credential theft has occurred.
• Train users on the double-submission pattern observed in the jeuxf[.]vu campaign: communicate explicitly that a login page returning an "incorrect password" error on the first attempt — followed immediately by an MFA or OTP prompt — is a known phishing technique designed to maximize credential yield, and that the correct response is to abandon the session and report it rather than re-enter credentials.
• Audit and restrict outbound calls initiated from organizational devices to unverified toll-free numbers presented inside browser windows, particularly following scareware-style browser lockup behavior; the z13.web.core.windows[.]net lure's entire conversion mechanism was a phone call, meaning no credential POST or network exfiltration event will appear in logs — the only detection opportunity is behavioral, at the endpoint or user level.

Learn how PhishID can help protect your district from cutting-edge threats like these! Schedule a Demo