PREY-0058 vishing lure domain query (passkey/MFA/SSO themed)

Arnold Chan@slaz

•updated Sep 8, 2026•1•0•1

Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.