NovaCookies AiTM lure: .vu domain with mixed-case share/access/view URI

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•1

This rule detects network activity associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing framework, specifically looking for traffic to domains with a .vu TLD, matching a specific URI pattern used for phishing lures in HTTP requests/responses, and related DNS queries.