Vishing-Linked AiTM Lure Domain Access (PREY-0058 Helpdesk Pretext)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•3

This rule detects network connections or DNS requests to domains specifically structured to impersonate MFA registration, passkey setup, or SSO login pages. These domain patterns are commonly associated with phishing campaigns intended to harvest credentials, session tokens, or bypass multi-factor authentication (AiTM phishing).