LLM API POST Requests Generating Phishing Kit or Malware Scaffolding

Duo Tech@duotech

•updated Jul 1, 2026•0•0•10

Detects HTTP POST requests to LLM chat completion API endpoints containing keywords associated with phishing kit generation, malware scaffolding, and automated credential harvesting. This behavior is consistent with attackers using LLM-assisted supply chain or phishing campaigns.