Passkey/SSO Vishing Lure Domain DNS Resolution

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects DNS queries for suspicious domains that use keywords typically associated with credential harvesting, passkey-based phishing, or rogue SSO/authentication portal setups. The rule flags domains containing terms like 'passkey', 'oktasession', 'keysync', and various 'setup' or 'connect' variations designed to deceive users into providing authentication credentials.