From 3 Domains to 75 — Pivoting Through the FACEIT/Steam Phishing Kit

This report documents a large-scale phishing campaign targeting FACEIT/Steam users that expanded from three known domains to 75 by pivoting on shared page titles, reused image resources, and a reusable 'XaoriWindow' JavaScript component which renders a convincing fake Steam login window to harvest credentials; the campaign shows continuous activity from July 2025 through June 2026 and includes resource hashes, domains, and script URLs useful for detection and mitigation.