Phishing emails impersonating AI providers with credential-harvesting developer console links
Detects phishing emails impersonating AI/LLM service providers that reference API keys or developer consoles and contain embedded URLs to login/signin/auth/console pages, consistent with token-jacking campaigns harvesting developer credentials.
Microsoft Sentinel (KQL)
