AiTM Reverse-Proxy Phishing Traffic to Passkey/SSO-Themed Domains

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects network traffic (TLS SNI or HTTP Host) to known domains associated with Adversary-in-the-Middle (AiTM) phishing campaigns. These domains mimic passkey, SSO, or account security portals to steal credentials and session cookies.