Sign in

⚠️ This was a phishing simulation

You just submitted credentials to a fake Xbox login page. In a real attack the attacker now owns everything you typed. Here is exactly what this page captured:

Red flags this page deliberately included for you to spot:

• The URL is not an official Xbox / Microsoft domain — always check the address bar.
• No real Microsoft account hand-off, 2FA, or passkey prompt.
• It accepts any input and "succeeds" — a real login validates.
• The page asks for your password directly instead of a Microsoft OAuth redirect.

Defense: verify the domain, use a password manager (it won't autofill on look-alike domains), and enable phishing-resistant 2FA (authenticator app / security keys).

Restart simulation