Between August 27, 2026 and September 09, 2026, our team analyzed six phishing campaigns targeting organizations across Nevada and Kentucky, split between credential-harvesting operations and tech-support scareware lures engineered to induce victim-initiated phone calls. On the credential side, attackers used form-POST submission to attacker-controlled endpoints, a double-submit flow that harvests both a password and a live MFA token in sequence, and injected JavaScript that actively suppresses passkey prompts and steers victims away from phishing-resistant authentication paths. Impersonated brands and services drawn from on-page evidence include Microsoft 365, Microsoft Entra ID, Microsoft Windows security tooling, Adobe Document Cloud, and the full range of major consumer email providers — Outlook, Office 365, Gmail, Yahoo, and AOL.
Infrastructure across the six incidents leaned heavily on legitimacy borrowing: two scareware pages ran on Microsoft's own Azure Front Door CDN under azurefd[.]net, a third was hosted on Azure Static Web Apps under web.core.windows[.]net, and the credential-harvesting pages loaded genuine Microsoft-signed CSS and JavaScript bundles from aadcdn.msftauth[.]net and aadcdn.msauth[.]net directly alongside attacker-controlled capture logic, meaning both browser UI and many automated scanners observed authentic Microsoft assets rendering throughout the lure. The most operationally significant detail across this period is the degree to which attackers built their deception infrastructure on top of Microsoft's own signed and reputation-clean services rather than novel attacker-registered domains, a pattern that systematically degrades the value of domain-reputation and TLS-certificate checks as a detection layer.
Domains Reviewed
- exloria[.]vu/GUY1/DynaView/login.microsoftonline/pass.php?id=1aad7d77999...
- check.xjoci[.]click/rsvp/
- viruswarning0902uslwbolm.z13.web.core.windows[.]net/
- uhqbxosdfdcbbbfjd.prevdoc[.]pro/49963816-8e36-4594-8c76-2111a06ec5c3/sam...
- i7utyfghj-g4dvfubrczanfhfy.z02.azurefd[.]net/wcdbcd/index.html?bcda=1-85...
- mahaaann-bzdgegdfbtdwakeq.z03.azurefd[.]net/wcdbcd/index.html?bcda=1-877...
A credential-harvesting page impersonating Microsoft 365's sign-in flow targeted a Nevada organization, presenting a pixel-faithful replica of the Azure AD authentication portal — complete with legitimate Microsoft CDN assets, the correct favicon, and a pre-populated victim email address in the identity banner. Activity was confined to September 06, 2026. The primary capture mechanism is a POST form submitting the harvested password field to session/mlog.php?id=ee7122458add011d4e681dfaa01eaccd42b73c5491579146b573980aede4a1e0 on the attacker-controlled domain exloria[.]vu, with the unique id parameter in both the landing URL and the POST target functioning as a per-victim tracking token that ties the credential submission back to the specific lure delivery.
A credential-harvesting page impersonating Adobe Document Cloud targeted a Kentucky organization, presenting visitors with a fake document-share portal that offered six email-provider sign-in buttons covering Outlook, AOL, Office 365, Yahoo, Gmail, and a generic "Other Mail" option. Activity was confined to September 06, 2026. Credentials are captured through a double-submit flow: on the first submission the form POSTs email, password, and provider label to next.php on the attacker-controlled host check.xjoci[.]click, which returns a fabricated "Invalid Credentials" error to prompt the user to re-enter their password; on the second submission the same POST fires again, the page transitions to a success state, and a timed sequence hides the login modal and surfaces an OTP popup that submits the six-digit code to Analysis405/otp_process.php, harvesting whatever multi-factor token the provider sends the victim.
A tech-support scareware page impersonating Microsoft Windows Support — complete with the four-square Windows logo, Segoe UI typography, and fabricated SmartScreen, Windows Firewall, and "Authentication Required" overlays — targeted a Kentucky organization with the goal of inducing a phone call rather than harvesting credentials through a form POST. Activity was confined to September 02, 2026. Nineteen additional floating "Security" and "System Error" toast notifications, each carrying identical copy about either a password requirement for System32 or a memory access violation at address 0x88412, tile the viewport to simulate a cascading system crisis; a custom SVG cursor overlay and a `cursor: none` declaration on the outermost container replace the real pointer, a small but deliberate detail that makes the page feel behaviorally broken before the user has read a word.
A credential-harvesting page impersonating Microsoft's Entra ID sign-in portal targeted a Kentucky organization, using the prevdoc[.]pro domain infrastructure to serve a near-pixel-perfect replica of the Microsoft 365 convergent login flow, with tenant branding explicitly set to "a Kentucky organization" in the $Config object and tenant ID 49963816-8e36-4594-8c76-2111a06ec5c3 hardcoded throughout. Activity was confined to September 02, 2026. Credential submission posts to uhqbxosdfdcbbbfjd.prevdoc[.]pro/49963816-8e36-4594-8c76-2111a06ec5c3/login, an attacker-controlled endpoint that mirrors Microsoft's own login URL structure, while injected JavaScript polling on the stomdoc[.]pro/Doc endpoint watches for the presence of SID and APISID cookies — Google session tokens — and redirects the browser there upon finding them, indicating the kit is harvesting both Microsoft credentials and any live Google session the victim carries.
A tech-support scareware page impersonating Microsoft Windows security tooling targeted a Kentucky organization, presenting a fabricated device-lockout alert alongside a toll-free callback number as the sole mechanism for "resolution." Activity was confined to September 01, 2026. Infrastructure delivery runs through azurefd[.]net, Microsoft's own Azure Front Door CDN, which allows the page to pass domain-reputation checks that would flag a novel attacker-registered domain; the phone number itself is embedded directly in the query string, suggesting the operator swaps numbers per campaign by simply changing the URL parameter rather than redeploying HTML. For defenders, the practical implication is that there is no network-layer exfiltration to detect — the organization's controls need to surface the user's outbound phone call or remote-access session, not a malicious POST request.
A tech-support scam page impersonating Microsoft Windows security tooling targeted a Kentucky organization, presenting a fake "device locked" alert layered over a non-functional credential form and multiple repetitions of a toll-free callback number. Activity was confined to August 31, 2026. The page is hosted on mahaaann-bzdgegdfbtdwakeq.z03.azurefd[.]net, meaning it runs on Microsoft's own Azure Front Door CDN, which lends the URL a microsoft-adjacent appearance in the address bar and causes network controls that allowlist *.azurefd[.]net to pass the traffic without inspection. For defenders, the implication is that endpoint and network telemetry will show no credential exfiltration event because none occurs on the wire — detection has to center on the phone number itself as the indicator, and user awareness training needs to address the callback-scam model explicitly, since the harm begins the moment a user dials rather than the moment they type.
Recommendations
- Configure proxy or DNS-layer controls to alert on POST submissions to `session/mlog.php` or any endpoint path carrying a long hex `id` parameter from a non-Microsoft domain — the specific URL structure observed in the exloria[.]vu and prevdoc[.]pro kits, where per-victim tracking tokens are embedded in both the landing URL and the form action, produces a detectable pattern distinct from legitimate Microsoft login traffic.
- Build detection signatures targeting Azure Static Web Apps and Azure Front Door subdomains (`*.web.core.windows[.]net`, `*.azurefd[.]net`) whose subdomain strings contain panic-inducing keywords (`virus`, `warning`, `locked`, `error`) combined with date-stamp or campaign-ID patterns — the subdomain `viruswarning0902uslwbolm` and the mahaaann-bzdgegdfbtdwakeq hosts observed this period followed exactly this template and would be flagged by a regex tuned to that structure without blocking the broader CDN tier.
- Enrich threat-hunting queries with JavaScript behavioral indicators specific to AiTM credential-harvesting kits: script blocks that suppress passkey prompts, auto-click "Try another way," or auto-dismiss MFA persistence checkboxes — all four behaviors were present in the prevdoc[.]pro kit and collectively signal a page engineered to defeat phishing-resistant authentication rather than merely mimic a login portal.
- Treat unexpected OTP delivery to a user's real authenticator app as a high-confidence incident trigger when preceded by a user-reported "invalid credentials" error on an unfamiliar site — the double-submit-then-MFA-capture sequence in xjoci[.]click is designed so that the OTP arrival is the last observable signal before full account compromise, and a help-desk workflow that escalates unsolicited MFA prompts reported by users can interrupt the kill chain at that step.
- For scareware lures hosted on legitimate CDN infrastructure where no form POST or network exfiltration occurs — as in both azurefd[.]net incidents — shift detection to endpoint and telephony signals: monitor for browser processes that remain fullscreen or in focus for abnormal durations without user navigation, and if your organization has CASB or telephony visibility, flag outbound calls to numbers that appear verbatim in recently visited URLs or page source, since the z02 and z03 campaigns embedded the callback number directly in the query string.
- Train users on the specific multi-provider lure model observed in xjoci[.]click: a fake document-share notification that presents six email-provider sign-in buttons is not a legitimate document portal, and any site requesting email credentials to "view a shared file" should be reported rather than used — frame training around this concrete scenario rather than generic phishing awareness, since the Adobe Document Cloud impersonation with provider-selection UI is a template the kit ecosystem reuses broadly.
- Apply tenant-branding monitoring to your Microsoft 365 environment: the prevdoc[.]pro kit hardcoded a real tenant ID and rendered accurate tenant branding by pulling it from Microsoft's own configuration endpoints, meaning users saw a visually correct logo and organization name — defenders should alert on sign-in attempts where the referrer or redirect URI does not match `login.microsoftonline[.]com` or `login.microsoft[.]com` even when tenant branding is correctly rendered, since brand accuracy is no longer a reliable authenticity signal.
Learn how PhishID can help protect your district from cutting-edge threats like these! Schedule a Demo
