DNS lookup to passkey/SSO-themed phishing domains (Storm-3121/3032)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects DNS lookups and TLS SNI requests to known domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns utilize passkey or Single Sign-On (SSO) themed lures to facilitate credential harvesting.