Fake GUI Login Prompt Delivered for Credential Capture

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the delivery of a fake GUI login prompt over HTTP, likely for credential capture. It looks for HTTP responses (flow:to_client) containing the strings "ShowDialog", "Password", and "GetWindowText" (case-insensitive) within the file data. This combination of keywords suggests an attempt to mimic a legitimate login interface to trick users into providing their credentials.