Vishing-linked AiTM phishing lure domain visited or emailed

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•7

This rule detects potential MFA phishing attempts by identifying access to known malicious domains used for MFA credential harvesting within email communications and network traffic. It flags instances where users interact with domains masquerading as legitimate multi-factor authentication setup or registration services.