Rogue OIDC EAM endpoints hosted on ngrok tunneling domain

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•5

Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.