Fake LastPass Authenticator GitHub/GitHub Pages phishing site

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.