ShapedPlugin - 2FA Plugin Generation Subdomain Regex

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

This rule detects network connections to subdomains of 'generate.2faplugin.org' using a regular expression. This infrastructure is associated with a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins were distributed via official channels. The regex is designed to catch varying subdomains related to this malicious infrastructure.