Antiphishing.biz

This screenshot shows a Spanish‑language phishing page designed to steal email credentials (correo electrónico and contraseña). The page is minimal and generic, making it adaptable to impersonate various services (Microsoft, Google, a bank, or an email provider).

---

Threat Analysis: Generic “Inicio de seguridad” Phishing – Credential Harvesting

How it works:
The victim receives a phishing email, SMS, or message claiming a security alert, account suspension, or the need to verify their information. The link leads to this page, which asks for:

• Email address
• Password

The “Siguiente” (Next) button suggests a multi‑step flow, where the victim would be taken to another fake page (e.g., for two‑factor authentication or additional personal data).

The goal:
The attacker steals the victim’s email credentials to:

• Access the email account (search for sensitive information, reset passwords for other services)
• Send further phishing messages to the victim’s contacts
• Use the credentials to compromise other accounts where the same password is reused

Red flags to watch for:

• Suspicious URL: The page is hosted on a domain like sc-445678-sss.c1.biz, which is not an official domain for any legitimate service (e.g., google.com, microsoft.com, outlook.com).
• Generic design: The page has no logo, no company branding, and no personalized elements – a strong indicator of a broad phishing campaign.
• “Inicio de seguridad” pretext: This vague “security start” phrase is meant to create a false sense of urgency but lacks the professionalism of a real security alert.
• Unsolicited login request: No legitimate service sends links requiring users to log in to resolve “security” issues.

What to do if you encounter this:

• Do not enter your email or password.
• If you have already entered credentials, change your password immediately for that email account and for any other accounts using the same password. Enable two‑factor authentication (2FA) on your email account.
• Always access your email or online services by typing the official URL directly into your browser.

Protective measures:

• Never click links in unsolicited messages claiming security issues.
• Use a password manager – it will not autofill on fake domains.
• Enable two‑factor authentication on your email and other critical accounts.
• Check the URL carefully: Look for misspellings, extra words, or unusual top‑level domains.

---

This phishing campaign utilizes a high-fidelity clone of the Microsoft account creation page to steal user credentials, personal data, and backup contact information under the guise of creating a new profile. The fake form, which often appears after clicking a deceptive link, captures the “new” password, which is frequently a recycled, primary password, along with PII that can be used to bypass 2FA on actual accounts. To stay safe, users should always verify that the URL resides on microsoft.com, live.com, or outlook.com and manually type addresses rather than clicking links.

Screenshot #1: The Data Entry Form

The Trap: The page is a pixel-perfect replica of the live.com registration screen. It asks for a new email address and a password.

The Psychology: Victims feel safe because they think they are creating information, not giving it away. However, most people use the same 1–2 passwords for everything. Once you click “Next,” your “new” password is sent directly to the attacker’s server.

Screenshot #2: Personal Data Collection

The Trap: After the password, the kit asks for First Name, Last Name, and Date of Birth.

The Intent: This is “Fullz” harvesting. This data is used to answer security questions on your real accounts or to perform identity theft and open fraudulent credit lines.

Screenshot #3: Verification & Backup Data

The Trap: The final step often asks for a Backup Email or Phone Number.

The Impact: By capturing your recovery methods, the attacker can try to take over your other accounts (Gmail, Facebook, Bank) by initiating password resets using the phone number or backup email you just provided.

Then user will be redirected to the true Microsoft website:

🛡️ Fake Microsoft Account Creation Page

Target: Global users of Outlook, OneDrive, and Azure services.
Threat Level: Critical (Credential Harvesting & Identity Theft)

Phishing Method Description

This attack targets users by mimicking the official Microsoft account creation (Sign-up) flow. Instead of stealing an existing password, scammers trick victims into “registering” for a new service or “validating” their identity. The goal is to capture a fresh set of credentials (Email + Password) which the victim likely reuses for other sensitive accounts.

---

🛡️ Protection Measures

• 1. Check the Top-Level Domain (TLD):
  Official Microsoft registration only happens on microsoft.com, live.com, or outlook.com. If you see a URL like microsoft-account-verify.net or signup-live.xyz, close the tab immediately.
• 2. The “Recycled Password” Danger:
  Never use your primary password when “registering” for a new, unknown service. Scammers rely on the fact that you will likely use your “standard” strong password, which they can then test against your banking and social media accounts.
• 3. Look for the “Padlock” and Certificate:
  While many phishing sites now use HTTPS (the lock icon), you can click it to see who the certificate was issued to. If it’s a random string of characters or an unrelated company, it’s a scam.
• 4. Use a Password Manager:
  A password manager (like Bitwarden or 1Password) will refuse to auto-fill your data if the domain is even slightly different from the real one. This is your best technical defense against lookalike sites.

---