MexicanMafia Operation Escaneo Phishing Pages set_phishing_poc and seeddms_phish

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects HTTP requests directed at known MexicanMafia Operation Escaneo phishing infrastructure, specifically targeting tax authority and SeedDMS document management users. The rule alerts on access to identified artifact filenames used in the campaign, such as phishing poc and spoofed document management pages.