Dark Caracal GoCaracal SVG-phishing DNS staging domains

Emiliano Mema@Nosalva

•updated Aug 31, 2026•0•0•0

Detects DNS queries for domains identified as part of the GoCaracal campaign, associated with the threat actor Dark Caracal. These domains are known to be used for the delivery and staging of SVG-based phishing attacks.