GhostCode Fake Document Portal Displaying Injected Device Code

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•1

This rule detects network activity (HTTP requests or DNS queries) interacting with specific suspicious domains that mimic Microsoft 365, Purview, or DocuSign authentication pages. These domains are identified by specific naming patterns and content markers indicative of credential harvesting or device code phishing attacks.