Skip to content
Scammers.com
PhishingReviewed

HeartSender phishing kit still active, using office-panel.com and office-token.com panels

Sandbox company ANY.RUN posted on X on 10 November 2026 that it is tracking the HeartSender phishing kit, which shows Microsoft 365, Google and other branded fake sign-in pages, including Microsoft "device code" login…

First reported
Reports
1

Source: x.com · published

ANY.RUN screenshot of a HeartSender Microsoft 365 device-code sign-in page
Image: ANY.RUN

What happened

Sandbox company ANY.RUN posted on X on 10 November 2026 that it is tracking the HeartSender phishing kit, which shows Microsoft 365, Google and other branded fake sign-in pages, including Microsoft "device code" login lures that ask victims to enter a code on the real Microsoft device-login page. ANY.RUN said about 52% of the kit's activity over the past six months was in the US, and that despite arrests in 2025 the service and its phishing infrastructure remain active. It listed the shared admin panels office-panel[.]com and office-token[.]com and the IP 103.153.182[.]197 as indicators. Microsoft and Google are spoofed brands, not the scammers. Never enter a device code that someone else sent you or that a web page asks you to copy.

How the scam works

HeartSender is sold as a kit, so many different fake login pages can be stood up quickly with the same back end. ANY.RUN described Microsoft 365, Google and other branded sign-in pages, including device-code lures. In a device-code lure, the victim is told to open the real Microsoft device-login page and enter a code the other site displays. That code, if entered, can grant the operator access to the Microsoft account without the victim typing a password into the look-alike page itself.

ANY.RUN said about 52 percent of the kit's activity over the past six months was in the United States and that the service and its infrastructure remain active despite arrests in 2025. It listed the shared admin panels office-panel.com and office-token.com and the IP 103.153.182.197 as indicators. Never enter a device code that a web page, email or message asked you to copy, even if the page you paste it into looks like Microsoft's. Microsoft and Google are spoofed brands, not the operators.

Source

Public post on X, 10 November 2026: https://x.com/anyrun_app/status/2120140364757557542

The indicators come from this source and have not been independently checked by scammers.com.

Red flags

  • A Microsoft, Google or other sign-in page reached from a link rather than an address you typed.
  • A page that tells you to enter a device code on the real Microsoft device-login site.
  • A request to copy a one-time code from an email, message or unfamiliar website.
  • Shared panel addresses such as office-panel.com or office-token.com in a link or redirect.

If you were targeted

  1. 1Never enter a device code that someone else sent you or that a web page asked you to copy.
  2. 2Type office.com or the official Google address yourself if you need to sign in.
  3. 3If you entered a code or password, change it, sign out other sessions and review recent activity.
  4. 4Report the page to Microsoft or Google through official channels.
  5. 5Be cautious of any device-activation page reached from email.
ReportFraud.ftc.gov FBI IC3 More resources

Related reports

All phishing reports
PhishingReviewed

GMX.net email login phishing page at xncok12.weebly.com

PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…

  • xncok12.weebly.com
  • Weebly subdomain; VirusTotal 17/92
Reported Nov 12, 20261 report