Credential Phishing Page with MFA Bypass Token

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP requests that appear to be credential phishing attempts, specifically looking for pages that might also attempt to bypass multi-factor authentication (MFA). It triggers when an HTTP URI contains the keywords "token", "verify", and "auth" (case-insensitive). This combination of keywords in the URI suggests a page designed to collect credentials and potentially an MFA bypass token.