AiTM phishing traffic to Forg365 reverse-proxy Microsoft login clone
Detects network and DNS traffic targeting known infrastructure used by the Forg365 adversary-in-the-middle (AiTM) phishing kit. This kit clones Microsoft login pages to intercept credentials and session cookies via reverse proxy.
YARA-L
