AiTM Phishing - Storm-2755 Payroll Pirates Lookalike Proxy Domain Contacted
Detects HTTP requests to known Storm-2755 Payroll Pirates AiTM lookalike proxy domains that also reference Microsoft authentication infrastructure in the URI, indicating a reverse-proxy phishing kit relaying to real Microsoft login endpoints.
Suricata
