MalwareTips: pages.dev Platform Update phishing page steals webmail passwords
MalwareTips says Platform Update emails link to a personalised fake webmail login on a pages.dev host that sends passwords to grandstores.live. Email providers are not involved.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips published an investigation on 6 November 2026 of a Platform Update email scam that personalises a fake webmail login. A notice claiming the recipient's address must be confirmed within 24 hours links to a page hosted at lookup-supprt-specializedsuppliers-team-resetline-compadin.pages.dev. Email providers whose branding the page fetches are impersonated and not involved.
How the scam works
MalwareTips says the email arrives under a generic webmail identity with the subject You have received Notification, warns that account activity and incoming messages depend on responding within 24 hours, and offers a Confirm Email Address button. It names no specific provider and gives no verifiable maintenance notice. The linked page's script reads a parameter named utm from the address, decodes the recipient's email address if needed, locks it into the form and fetches matching provider branding, so the logo shown need not come from the provider.
When submitted, the form packages the email address and password and sends them to a separate collection destination on grandstores.live, rather than through Google's or any provider's normal sign-in. A failed-login message can appear whatever the outcome, and a later redirect to a familiar website can make the episode look like a temporary glitch. MalwareTips stresses that this does not mean the password stayed safe. Confirming an address and entering your existing mailbox password are different actions, and the email blurs them together.
MalwareTips advises not using the confirmation button or entering passwords on this route. Check any real account notice by opening your email service through its usual app or bookmark, as Google's phishing guidance recommends. Anyone who entered a password should change it through the real provider, sign out other sessions, review forwarding rules and recovery settings, and enable two-step verification. Employees should tell their IT team.
Source
MalwareTips investigation, 6 November 2026: https://malwaretips.com/blogs/platform-update-email-confirmation-webmail-password-scam/
Red flags
- An email titled You have received Notification about an unspecified platform update.
- A 24-hour deadline to confirm your address or lose incoming mail.
- A Confirm Email Address button that leads to a password form.
- A login page already filled in with your email address and your provider's logo.
- A login page hosted on pages.dev or another free hosting address.
If you were targeted
- 1Do not enter your mailbox password on a page reached from an email link.
- 2Check account notices by opening your email app or a saved bookmark yourself.
- 3If you entered your password, change it through the real provider and sign out other sessions.
- 4Review forwarding rules and recovery settings, and turn on two-step verification.
- 5At work, report the email to your IT or security team.