Email/URL referencing PREY-0058 passkey-lure keywords (vishing follow-up)

Detects inbound emails or URL click events that contain specific keywords associated with the PREY-0058 vishing campaign. These keywords are used to lure victims to attacker-controlled pages designed for credential harvesting or MFA/passkey registration.