Phishing for Xfinity credentials with malicious Zoom Docs · Blog · Sublime Security

This Attack Spotlight describes a credential-phishing campaign where attackers impersonated Xfinity, used a Zoom Doc (docs.zoom.us) to host an Xfinity-branded landing page, and redirected victims to a separate phishing domain to harvest credentials; Sublime's AI (ASA) detected the attack using signals including brand impersonation, domain mismatch, urgent language, and intentional misspellings for filter evasion.