Vishing-Themed AiTM Phishing Domain Access (Passkey/MFA Lure Domains)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•7

This rule detects access to known malicious domains used in vishing-themed Adversary-in-the-Middle (AiTM) phishing campaigns. Attackers use these domains to deceive users into providing MFA credentials or session tokens, often following a voice phishing interaction where victims are directed to these sites to register or set passkeys.