GhostCode-style 'account-access-'/'secure-access-' phishing subdomain HTTP reque

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•2

Detects network activity associated with the GhostCode phishing kit, including HTTP requests to specific access-prefixed subdomains and DNS lookups for those domains. Additionally, it detects HTTP responses containing specific spoofed browser tab titles often used in these phishing campaigns.