Passkey/SSO Update Vishing-SMS Lure Preceding Authentication Event

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•1

This rule detects a correlation between an incoming email, SMS, or message containing phishing lure keywords related to 'passkey' or 'SSO' and 'update' requests, followed by a successful or attempted user sign-in from that recipient within a 2-hour window. This behavior is indicative of a social engineering campaign aimed at credential or token theft.