New Phishing exploit Vercel to Host and Deliver Remote Access malware

Kaung Khant Ko@kaungkhantko

•updated Jan 27, 2026•19•1•108

This rule detects network connections to a predefined list of malicious domains, many of which are hosted on Vercel and appear to be associated with phishing campaigns. The domains often mimic legitimate services or financial documents, suggesting an attempt to deliver malware or steal credentials through phishing. The rule specifically looks for these domains in the 'RemoteUrl' field of 'DeviceNetworkEvents'.