Between August 27, 2026 and September 09, 2026, our team analyzed six phishing campaigns targeting organizations across Nevada and Kentucky, split between credential-harvesting operations and tech-support scareware lures engineered to induce victim-initiated phone calls. On the credential side, attackers used form-POST submission to attacker-controlled endpoints, a double-submit flow that harvests both a password and a live MFA token in sequence, and injected JavaScript that actively suppresses passkey prompts and steers victims away from phishing-resistant authentication paths. Impersonated brands and services drawn from on-page evidence include Microsoft 365, Microsoft Entra ID, Microsoft Windows security tooling, Adobe Document Cloud, and the full range of major consumer email providers — Outlook, Office 365, Gmail, Yahoo, and AOL.
Infrastructure across the six incidents leaned heavily on legitimacy borrowing: two scareware pages ran on Microsoft's own Azure Front Door CDN under azurefd[.]net, a third was hosted on Azure Static Web Apps under web.core.windows[.]net, and the credential-harvesting pages loaded genuine Microsoft-signed CSS and JavaScript bundles from aadcdn.msftauth[.]net and aadcdn.msauth[.]net directly alongside attacker-controlled capture logic, meaning both browser UI and many automated scanners observed authentic Microsoft assets rendering throughout the lure. The most operationally significant detail across this period is the degree to which attackers built their deception infrastructure on top of Microsoft's own signed and reputation-clean services rather than novel attacker-registered domains, a pattern that systematically degrades the value of domain-reputation and TLS-certificate checks as a detection layer.
A credential-harvesting page impersonating Microsoft 365's sign-in flow targeted a Nevada organization, presenting a pixel-faithful replica of the Azure AD authentication portal — complete with legitimate Microsoft CDN assets, the correct favicon, and a pre-populated victim email address in the identity banner. Activity was confined to September 06, 2026. The primary capture mechanism is a POST form submitting the harvested password field to session/mlog.php?id=ee7122458add011d4e681dfaa01eaccd42b73c5491579146b573980aede4a1e0 on the attacker-controlled domain exloria[.]vu, with the unique id parameter in both the landing URL and the POST target functioning as a per-victim tracking token that ties the credential submission back to the specific lure delivery.
A credential-harvesting page impersonating Adobe Document Cloud targeted a Kentucky organization, presenting visitors with a fake document-share portal that offered six email-provider sign-in buttons covering Outlook, AOL, Office 365, Yahoo, Gmail, and a generic "Other Mail" option. Activity was confined to September 06, 2026. Credentials are captured through a double-submit flow: on the first submission the form POSTs email, password, and provider label to next.php on the attacker-controlled host check.xjoci[.]click, which returns a fabricated "Invalid Credentials" error to prompt the user to re-enter their password; on the second submission the same POST fires again, the page transitions to a success state, and a timed sequence hides the login modal and surfaces an OTP popup that submits the six-digit code to Analysis405/otp_process.php, harvesting whatever multi-factor token the provider sends the victim.
A tech-support scareware page impersonating Microsoft Windows Support — complete with the four-square Windows logo, Segoe UI typography, and fabricated SmartScreen, Windows Firewall, and "Authentication Required" overlays — targeted a Kentucky organization with the goal of inducing a phone call rather than harvesting credentials through a form POST. Activity was confined to September 02, 2026. Nineteen additional floating "Security" and "System Error" toast notifications, each carrying identical copy about either a password requirement for System32 or a memory access violation at address 0x88412, tile the viewport to simulate a cascading system crisis; a custom SVG cursor overlay and a `cursor: none` declaration on the outermost container replace the real pointer, a small but deliberate detail that makes the page feel behaviorally broken before the user has read a word.
A credential-harvesting page impersonating Microsoft's Entra ID sign-in portal targeted a Kentucky organization, using the prevdoc[.]pro domain infrastructure to serve a near-pixel-perfect replica of the Microsoft 365 convergent login flow, with tenant branding explicitly set to "a Kentucky organization" in the $Config object and tenant ID 49963816-8e36-4594-8c76-2111a06ec5c3 hardcoded throughout. Activity was confined to September 02, 2026. Credential submission posts to uhqbxosdfdcbbbfjd.prevdoc[.]pro/49963816-8e36-4594-8c76-2111a06ec5c3/login, an attacker-controlled endpoint that mirrors Microsoft's own login URL structure, while injected JavaScript polling on the stomdoc[.]pro/Doc endpoint watches for the presence of SID and APISID cookies — Google session tokens — and redirects the browser there upon finding them, indicating the kit is harvesting both Microsoft credentials and any live Google session the victim carries.
A tech-support scareware page impersonating Microsoft Windows security tooling targeted a Kentucky organization, presenting a fabricated device-lockout alert alongside a toll-free callback number as the sole mechanism for "resolution." Activity was confined to September 01, 2026. Infrastructure delivery runs through azurefd[.]net, Microsoft's own Azure Front Door CDN, which allows the page to pass domain-reputation checks that would flag a novel attacker-registered domain; the phone number itself is embedded directly in the query string, suggesting the operator swaps numbers per campaign by simply changing the URL parameter rather than redeploying HTML. For defenders, the practical implication is that there is no network-layer exfiltration to detect — the organization's controls need to surface the user's outbound phone call or remote-access session, not a malicious POST request.
A tech-support scam page impersonating Microsoft Windows security tooling targeted a Kentucky organization, presenting a fake "device locked" alert layered over a non-functional credential form and multiple repetitions of a toll-free callback number. Activity was confined to August 31, 2026. The page is hosted on mahaaann-bzdgegdfbtdwakeq.z03.azurefd[.]net, meaning it runs on Microsoft's own Azure Front Door CDN, which lends the URL a microsoft-adjacent appearance in the address bar and causes network controls that allowlist *.azurefd[.]net to pass the traffic without inspection. For defenders, the implication is that endpoint and network telemetry will show no credential exfiltration event because none occurs on the wire — detection has to center on the phone number itself as the indicator, and user awareness training needs to address the callback-scam model explicitly, since the harm begins the moment a user dials rather than the moment they type.
Learn how PhishID can help protect your district from cutting-edge threats like these! Schedule a Demo