Fake CAPTCHA pages on gincolabjsoj.top and related domains steal Microsoft 365 logins

What happened

Trustwave SpiderLabs (LevelBlue) posted on X on 10 November 2026 that many phishing URLs seen on VirusTotal open with a fake "verify you're not a robot" CAPTCHA that then sends visitors to a cloned Microsoft 365 sign-in page. SpiderLabs said the pages run an adversary-in-the-middle phishing kit that requests a refresh token, so signing in hands the attacker ongoing access to the account. Indicators it listed: view.gincolabjsoj[.]top, validate.accessprojecthome[.]casa, app.subteratech[.]com, login.arvestmtg[.]com and service.detilplace[.]sbs. Microsoft is the brand being spoofed and is not involved. Sign in to Microsoft 365 only at addresses you type yourself, and be wary of CAPTCHA pages reached from email links.

How the scam works

According to SpiderLabs, the first page is a fake CAPTCHA that asks the visitor to prove they are human. Completing that check redirects to a copy of a Microsoft sign-in page. Credentials and session tokens entered there can be captured through a proxy, which can let the operator use the account even if a second factor is approved in the moment.

The researchers listed several related hosts with a shared URL pattern, including view.gincolabjsoj.top, validate.accessprojecthome.casa, app.subteratech.com, login.arvestmtg.com and service.detilplace.sbs. Microsoft is the brand being spoofed and is not involved. Sign in to Microsoft 365 only at addresses you type yourself, and treat unexpected CAPTCHA or "verify you are human" pages reached from email links as suspicious. The write-up comes from the researchers' public post.

Source

Public post on X, 10 November 2026: https://x.com/SpiderLabs/status/2120176249003823154

The indicators come from this source and have not been independently checked by scammers.com.