Between July 16 and July 29, 2026, our team analyzed six distinct phishing campaigns targeting organizations across California, Florida, Georgia, Kentucky, Minnesota, Texas, and Virginia, with activity patterns ranging from a sustained twelve-detection run spanning nearly two weeks to single-session events confined to one day. Across the six incidents, credential capture was accomplished through four distinct mechanisms: phone-callback social engineering where the voice channel serves as the exfiltration point, real-time WebSocket transmission of field values via socket.io, JavaScript relay functions posting harvested credentials to attacker-controlled backend infrastructure, and synchronous HTML form POSTs to PHP endpoints — with three of the six campaigns layering an OTP or MFA capture stage on top of the initial password harvest.
The brands used as lures span Microsoft Support, Microsoft 365, Adobe, Netflix, Greenvelope, Outlook, Office 365, Yahoo, and AOL, with Microsoft-themed presentation appearing across four of the six incidents in varying forms. On the infrastructure side, operators showed a clear preference for legitimacy laundering: one page ran entirely on Azure Static Web Apps with paid Facebook ad attribution threading traffic through Meta's delivery pipeline, a second pulled its WebSocket library from cdnjs.cloudflare[.]com, and a third leaned on a cpanel[.]site subdomain over a raw IPv4 address to approximate the appearance of managed hosting.
Domains Reviewed
- viruswarning0728usepkcox.z13.web.core.windows[.]net/?utm_medium=paid&utm... (12 variants)
- lmz2st9e1n.maiden-stones[.]com/soil5_tea1_morning5_branch10_sheep5_flowe...
- use-einvite[.]mom/login/microsoft.html?sid=sess_9us61pufms0p1ifz
- beizw[.]vu/cxv/zse/AdobeA/
- essentialzjamxbeachfam[.]one/paperlesscountdown/
- manage-roll-paymentapp.165-154-225-173.cpanel[.]site/?anjaymabar
A tech-support scareware page impersonating Microsoft Support — complete with the Windows logo, a faked "SmartScreen - Preventive Block" banner, and a simulated "Authentication Required" lockout dialog — targeted a California, Florida, Georgia, Kentucky, Minnesota, and Texas organization with the goal of driving victims to call a fraudulent support number. Activity was observed across the period from July 16, 2026 to July 28, 2026, comprising 12 separate detections, indicating a sustained campaign rather than a single-blast delivery. The page layers roughly twenty overlapping fake toast notifications labeled "Security" and "System Error" across the viewport — carrying messages such as "Password required for System32" and "Memory access violation at 0x88412" — while setting cursor to none to disorient the user and applying high z-index layering that prevents interaction with the underlying content, a combination designed to manufacture a convincing sense of system lockdown without any genuine OS-level code execution.
Related subdomain variants:
- viruswarning0716us20yib8.z13.web.core.windows[.]net
- viruswarning0717us6n85kl.z13.web.core.windows[.]net
- viruswarning0717usty6tuw.z13.web.core.windows[.]net
- viruswarning0720us4o74cr.z13.web.core.windows[.]net
- viruswarning0722us6gmc45.z13.web.core.windows[.]net
- viruswarning0722us876v7n.z13.web.core.windows[.]net
- viruswarning0722us9qbxw5.z13.web.core.windows[.]net
- viruswarning0722usym57n6.z13.web.core.windows[.]net
- viruswarning0723us7emy86.z13.web.core.windows[.]net
- viruswarning0724uss8zbhh.z13.web.core.windows[.]net
- viruswarning0724usxvst3r.z13.web.core.windows[.]net
- viruswarning0728usepkcox.z13.web.core.windows[.]net
A credential-harvesting page impersonating Microsoft 365 targeted a Texas organization, rendering a pixel-accurate Fluent UI sign-in portal built from Microsoft's own design-system token library and served from the subdomain lmz2st9e1n.maiden-stones[.]com. Activity was confined to July 27, 2026, with a single observed event. The primary capture mechanism is a WebSocket session established via socket.io 4.8.1, loaded from cdnjs.cloudflare.com, which replaces the conventional form-POST pattern entirely: credentials typed into the Fluent UI input fields are transmitted in real time over a persistent WebSocket connection back to attacker-controlled infrastructure, allowing the operator to receive each keystroke or field value without the page ever performing a traditional HTTP form submission that network controls might log.
The URL path encodes a long pseudo-random token string composed of dictionary words and numbers, a structure consistent with per-victim tracking links embedded in phishing email, meaning the operator can correlate a submitted credential set directly to the targeted individual and know whether the link was clicked. Because credential delivery happens over an encrypted, long-lived WebSocket rather than a POST to a visible endpoint, proxy-based inspection tools that pattern-match on form action URLs or outbound POST destinations will not surface this traffic in the way they would a conventional phishing page.
A credential-harvesting page impersonating Microsoft 365 targeted a Virginia organization, presenting a pixel-accurate replica of the Microsoft sign-in portal — including the four-square logo rendered in inline SVG, Segoe UI typography, and the characteristic two-step email-then-password flow — hosted at use-einvite[.]mom. Activity was confined to July 25, 2026. Credential capture runs through a JavaScript object called EviteRelay.submitPassword(), which accepts the harvested email and password and relays them to attacker-controlled backend infrastructure loaded via two external scripts, ../assets/login-config.js and ../assets/poll.js, whose contents were not recoverable but whose naming convention suggests a polling-based exfiltration relay rather than a direct form POST.
The page also implements MFA capture: the handle() function inspects the server's JSON response, and if the backend returns mfa_required, the browser is redirected to /mfa/microsoft with the victim's email, session ID, harvested display number, and device name appended as query parameters, meaning the kit is designed to catch second-factor challenges in addition to primary credentials. The URL parameter sid=sess_9us61pufms0p1ifz is stored in sessionStorage and threaded through every subsequent request, giving the attacker a stable per-victim token to correlate the harvested password with any MFA response that follows. For defenders, the implication is that catching the initial credential theft is only part of the problem — a victim who enters their password and then completes an MFA prompt on this page may have surrendered both factors to the attacker in a single session.
A credential-harvesting page impersonating Adobe and the Greenvelope online invitation service targeted a Florida organization, presenting victims with a multi-provider login portal that collected credentials for Outlook, Office 365, Yahoo, AOL, and generic email accounts. Activity was confined to July 21, 2026. The primary capture mechanism is a form POST to processmail.php on attacker-controlled infrastructure at beizw[.]vu, with credentials serialized via jQuery's form.serialize() and transmitted over AJAX; a deliberate double-submit pattern disguised as authentication failure displays an "Incorrect Password" message on the first submission and silently upgrades the form's CSS class on the second, coaxing the victim into re-entering credentials before advancing the flow.
Following credential collection, a second modal presents an OTP prompt that POSTs to process.php on the same host, meaning the kit is designed to capture a live multi-factor code in addition to the password, a capability that directly undermines time-based one-time password controls. The Gmail button deviates from the modal pattern and instead redirects victims to beizw[.]vu/hdjd/accounts.google in a new tab, suggesting that path is handled by a separate page or relay rather than the same PHP back-end. The double-submit error trick is the behavioral tell most likely to catch a victim off guard, because a user who sees "Incorrect Password" after entering correct credentials will often try again rather than abandon the page, effectively handing the attacker a confirmed, double-verified credential pair alongside a fresh OTP.
A credential-harvesting page impersonating Greenvelope, an online invitation service, used an Adobe logo and multi-provider email login buttons to target a Florida organization. Activity was confined to July 20, 2026. Credentials are submitted via a synchronous AJAX POST to processmail[.]php on the attacker-controlled server, and the kit deliberately returns an "Incorrect Password" error on the first submission to prompt a second entry, doubling the likelihood of capturing a valid credential pair before advancing the victim to the next stage.
After the second submission the kit transitions to an OTP capture modal that displays a countdown timer and instructs the victim to enter a code sent to their phone, meaning the operator is positioned to harvest a time-based one-time password alongside the stolen username and password. The combination of a double-submit credential harvest feeding directly into an OTP capture stage means a user who completes all three steps has handed an attacker everything needed to authenticate in real time, so detection at the email-delivery layer — before the link is clicked — is the only control point that reliably disrupts the full chain.
A credential-harvesting page impersonating Netflix targeted a California organization, presenting a pixel-accurate reproduction of the Netflix sign-in interface complete with the SVG wordmark, a dark-themed login form, and footer links lifted from the legitimate service. Activity was confined to July 19, 2026, with a single observed event. The primary capture mechanism is a synchronous HTML form collecting email address and password fields, with credential exfiltration logic deferred entirely into the bundled JavaScript at ./static/js/main.7676a408.js, meaning the POST target and any relay endpoint are obscured from static HTML inspection and only resolve at runtime.
The page is hosted on a raw IPv4 address — 165.154.225.173 — dressed up with a cpanel[.]site subdomain and a path segment structured to suggest a payment management application, a framing choice that implies the operators expected users to rationalize a credential prompt in a billing or account-management context. The mention of Google reCAPTCHA protection is rendered as inert footer text with no functional reCAPTCHA integration visible in the markup, a pattern commonly used to project legitimacy to a user who reads the page before deciding whether to submit credentials.
Recommendations
- Configure WebSocket inspection or session-layer monitoring to flag persistent socket.io connections (as observed on maiden-stones[.]com) that originate from browser sessions navigating away from known Microsoft 365 login flows — conventional proxy controls that pattern-match on form POST destinations will silently pass WebSocket-based credential exfiltration entirely.
- Deploy FIDO2/hardware-bound authentication (passkeys or physical security keys) for Microsoft 365 access in organizations that have received phishing lures this period; the AiTM-capable kits observed at use-einvite[.]mom and beizw[.]vu are purpose-built to relay TOTP codes in real time, meaning TOTP-based MFA is a control these operators have explicitly engineered around, while FIDO2 origin-binding breaks the relay by design.
- Monitor Azure Static Web Apps subdomains (*.web.core.windows[.]net) appearing in inbound email links or web-proxy logs for pages serving tech-support scareware patterns — do not block the parent domain, but alert on newly observed subdomains under it that carry UTM parameters attributing traffic to social-media ad campaigns (utm_source=fb, fbclid), because the observed delivery chain at z13.web.core.windows[.]net exploited the implicit trust that reputation filters extend to Microsoft-owned infrastructure.
- Train users specifically on the double-submission "Incorrect Password" trick documented at beizw[.]vu and essentialzjamxbeachfam[.]one: instruct them that a login failure on an unsolicited link is a behavioral indicator of a credential-harvesting kit — not an authentication error — and that re-entering credentials after such a failure is the action the attacker depends on to confirm and duplicate the stolen pair.
- Add detection logic for JavaScript-obscured POST targets by flagging pages where the HTML form action is absent or points to a relative path (e.g., processmail.php, process.php on the same attacker-controlled host) while the page visually replicates a major service login; the kits at beizw[.]vu and essentialzjamxbeachfam[.]one both used this structure, and it is reliably distinct from how legitimate service providers construct their authentication flows.
- Develop and deliver targeted user awareness around the tech-support scareware pattern observed at z13.web.core.windows[.]net: specifically, that fabricated browser overlays mimicking Windows SmartScreen warnings, toast notifications referencing System32 or memory addresses, and a disabled cursor are rendered entirely in HTML and CSS — they reflect no actual OS state — and that any page asking users to call a phone number to resolve a "security lockout" should be treated as a social-engineering lure regardless of how legitimate the hosting domain appears.
- Apply URL reputation scrutiny to uncommon TLDs (.mom, .vu, .one) hosting pages that load Microsoft Fluent UI design tokens or render the Microsoft four-square SVG logo, as seen at use-einvite[.]mom and essentialzjamxbeachfam[.]one; these TLDs carry no operational reason to serve Microsoft-branded authentication flows, making the combination a reliable signal for newly deployed phishing infrastructure that has not yet accumulated reputation history.
Learn how PhishID can help protect your district from cutting-edge threats like these! Schedule a Demo
