Ousaban Phishing PDF Lure Attachment Linking to facture-in.pages.dev

Duo Tech@duotech

•updated Jul 2, 2026•1•0•1

This rule detects the creation of files with naming conventions associated with common document-based phishing lures (e.g., invoices, fiscal documents) or DNS requests to specific domains (e.g., pages.dev) frequently leveraged by attackers for hosting malicious content.