Passkey/SSO Update Lure Phishing Email Targeting Authentication Flow

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•12

This rule detects email activity containing keywords related to SSO or passkey updates combined with urgent terminology and support request language. This pattern is commonly indicative of phishing attempts aimed at stealing credentials or tricking users into providing sensitive information.