Most Important ShinyHunters Detection 2026: Rogue OIDC Redirect During MFA (TrustSink Credential Capture)

Ibrahim Saud@tektrix

•updated 28 days ago•0•0•1

Detects user authentication events where the MFA redirect URL points to an unrecognized or potentially malicious domain. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, such as the TrustSink credential capture technique, where the user is diverted from the legitimate identity provider to an attacker-controlled OIDC endpoint to capture credentials or session tokens.