DNS/HTTP query to known passkey/SSO-themed phishing domains

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

This rule monitors DNS queries and HTTP traffic for indicators related to known phishing infrastructure impersonating passkey and SSO providers. The domains detected are associated with Storm-3121/3032 campaigns designed to facilitate credential or session harvesting.