Possible kernel-level WFP redirection to unexpected local proxy port retaining original destination header (Phantom Mantis G12/G13)

Duo Tech@duotech

•updated Aug 4, 2026•0•0•4

Detects possible kernel-level WFP redirection of outbound HTTP connections to an unexpected local loopback proxy port while the original destination host header is retained, consistent with Phantom Mantis G12/G13 network redirection.