Mir0Auth device-code phishing kit beacon POST /task_queue.cs with octet-stream body

Arnold Chan@slaz

•updated 16 days ago•0•0•5

Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.