DNS/TLS lookup to known passkey/SSO phishing domains (Storm-3121/3032)

Ibrahim Saud@tektrix

•updated Sep 16, 2026•1•0•0

Detects DNS queries and TLS SNI traffic related to known malicious domains used by threat actor groups Storm-3121 and Storm-3032 in passkey-themed phishing campaigns.