Passkey/SSO-themed phishing domain query (Storm-3121/Storm-3032)

Arnold Chan@slaz

•updated Sep 10, 2026•1•0•5

Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.