Tracked hunts and campaigns, each anchored to a script fingerprint, a YARA rule, a search query or a TLS certificate. Every scanned script and page is matched against them automatically.
299 hunts·35 hit in the last 24 hours·59,466 sightings
highunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing consistent with UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk and walk employees through an urgent passkey, SSO or MFA enrolment on a look-alike sign-in page, where an adversary-in-the-middle panel relays the password and second factor live. The lure hosts are subdomains named after the targeted organisation under generic root domains. The roots in this row were not named in the published report. They are linked to it by shared registration infrastructure: the same privacy registrar and the same uncommon nameserver set as report-listed roots such as addmypasskey[.]com and myoktasso[.]com, registration dates in the same bursts (for example passkeys-setup[.]com on the same day as addmypasskey[.]com), and the same verb-plus-passkey, SSO or Okta naming. Several also appear on public threat lists under the 0ktapus SSO phishing cluster.
highunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing consistent with UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk and walk employees through an urgent passkey, SSO or MFA enrolment on a look-alike sign-in page, where an adversary-in-the-middle panel relays the password and second factor live. The lure hosts are subdomains named after the targeted organisation under generic root domains. The roots in this row were not named in the published report. They are linked to it by shared registration infrastructure: the same privacy registrar and the same uncommon nameserver set as report-listed roots such as addmypasskey[.]com and myoktasso[.]com, registration dates in the same bursts (for example passkeys-setup[.]com on the same day as addmypasskey[.]com), and the same verb-plus-passkey, SSO or Okta naming. Several also appear on public threat lists under the 0ktapus SSO phishing cluster.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalunc6671-passkey-sso-2026-09phishingmatches by queryadded 2026-09-25
Targeted identity-provider phishing attributed in public reporting to UNC6671, the vishing and extortion group behind the BlackFile, Redact, Pink, Helix and Falcon brands. Callers pose as the IT helpdesk, often phoning employees on personal mobiles, and walk them through an urgent passkey or MFA enrolment on a look-alike sign-in page. An adversary-in-the-middle panel relays the password and second factor live, including push approvals, number matching and SMS codes, and the stolen session is then used to pull data from Microsoft 365, Okta and other SaaS tenants. The lure hosts are subdomains named after the targeted organisation under generic root domains that pair a verb with "passkey", "sso", "mfa" or "okta" (for example registerpasskey[.]com, oskeysync[.]com, portalsetuphub[.]com). This row covers root domains published by Google Threat Intelligence Group.
criticalconsentfix-oauth-code-2026-09phishingmatches by queryadded 2026-09-25
Behavioural anchor for ConsentFix-style OAuth authorization-code phishing. Matches a scan in which the page itself sent the browser to the Microsoft identity platform's authorize endpoint for a pre-consented first-party public client (Azure CLI, Azure PowerShell, Visual Studio / VS Code, Teams or SharePoint PowerShell, Microsoft Office, the Authentication Broker) with a redirect_uri of http://localhost or the native-client page. That is how the lure obtains a code for the victim's account: a web page has no reason to start a desktop tool's sign-in, and the only use of the resulting localhost URL is to have the visitor hand it back. Includes pages where the sign-in only opens after clicking the page's own 'Sign in' / 'Verify' button, including the pop-up (drag-and-drop) variant.
criticalconsentfix-oauth-code-2026-09phishingmatches by YARAadded 2026-09-25
ConsentFix is a ClickFix-style account takeover with no credential form. The lure page (often behind a fake Cloudflare Turnstile or 'verify you are human' step) sends the victim to the genuine Microsoft sign-in page for a pre-consented first-party public application, most often Microsoft Azure CLI (04b07795-8ddb-461a-bbee-02f9e1bf7b46) or Azure PowerShell (1950a258-227b-4e31-a9cf-717495945fc2), with a redirect_uri of http://localhost. A victim who is already signed in is bounced straight to a localhost URL carrying an OAuth authorization code, and the page asks them to copy that URL back into it (v1) or drag it across from a pop-up window (v2). Public clients have no secret, so the code alone is exchanged for access and refresh tokens on the attacker's machine, bypassing most Conditional Access policies. The same technique has been linked to APT29 and has since been packaged into a criminal toolkit (v3). This hunt matches the lure page itself: Microsoft authorize URL + loopback or nativeclient redirect + a first-party public client id + code that reads the resulting URL back from the victim (paste or drop handler, or code= extraction).
highuta0560-chrome-0day-2026-09othermatches by queryadded 2026-09-23
Infrastructure published by Volexity for UTA0560, one of the Chinese threat actors that chained Google Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) zero-days in early September 2026. shinewrist[.]net and cloud.shinewrist[.]net hosted the exploit chain; opusaccel[.]top and its subdomains (ocr., www.) served as command-and-control for the GRIMWEDGE backdoor.
highjunglebamboo-chrome-0day-2026-09othermatches by queryadded 2026-09-23
Infrastructure published by Volexity for JungleBamboo, a Chinese threat actor that delivered the Chrome zero-day CVE-2026-85046 in early September 2026 through phishing domains (msbenefit[.]com, gitprogram[.]com, m365update[.]com) and installed a malicious Chrome extension, LONGTALE, whose command-and-control ran on karlmalexander.workers[.]dev.
highuta0565-chrome-0day-2026-09othermatches by queryadded 2026-09-23
Domains published by Volexity for UTA0565, a Chinese threat actor that used chained Google Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) zero-days in early September 2026. Phishing emails linked to look-alike sites (americanprgoress[.]top, chinadigitaltimes[.]top, borneobulletins[.]top) that show the real site's content and load the exploit kit in a hidden iframe (/config.html, title site-config). The payload, CLEANGULP, calls back over HTTP to thecovnresation[.]com.
highuta0565-chrome-0day-2026-09othermatches by queryadded 2026-09-23
Addresses that served UTA0565's spoofed domains around 2–3 September 2026. 96.9.125[.]52 is published by Volexity (the fake China Digital Times site). The other four are DNS resolutions of Volexity-published domains observed in certificate-transparency monitoring: 216.203.20[.]177 (americanprgoress[.]top), 69.67.173[.]211 (borneobulletins[.]top), 195.85.115[.]163 (outsourcingwise[.]net) and 69.48.228[.]19 (personclouds[.]com and halaltak[.]net).
mediumdarkme-griffith-2026-09othermatches by queryadded 2026-09-17
Two domains reported as historical DarkMe infrastructure by a single source (Breakglass, "The Sentinel Variant", published 9 March 2026): russia978.sytes.net and mastrrokiakivasai.com. The attribution has not been independently corroborated, neither domain is confirmed as Griffith infrastructure, and the publication date is not a date the infrastructure was observed. Matches scans of these domains and pages that contact them. Kept separate from the vendor-published indicators so that a match is not read as vendor-confirmed.
highdarkme-griffith-2026-09othermatches by queryadded 2026-09-17
Scans whose submitted or final URL is on a domain published for the December 2023 to February 2024 DarkMe campaign reported by Trend Micro as Water Hydra (CVE-2024-21412). fxbulls.ru was the delivery website. unfawjelesst322.com was a DarkMe command-and-control domain, also identified by SonicWall. 87iavv.com and p2oaviwt39ui.com were published as campaign network indicators without an established role. These indicators are historical. Current ownership and activity have not been verified, so a match is a lead for review, not evidence that a site is malicious today. Virus Bulletin groups the DarkMe family with GriffithRAT under the Griffith intrusion set, but these indicators establish a DarkMe association only, not Griffith attribution.
mediumdarkme-griffith-2026-09othermatches by queryadded 2026-09-17
Scans that connected to, or were submitted directly as, one of five IP addresses published for the December 2023 to February 2024 DarkMe campaign reported by Trend Micro as Water Hydra (CVE-2024-21412). 84.32.189.74 hosted the HTTP/WebDAV delivery share (for example http://84.32.189.74/fxbulls/pictures/photo_2023-12-29.jpg.url). 179.43.172.127, 179.43.172.191, 64.31.63.70 and 64.31.63.194 were published as campaign IPs without a stated role. Rated medium because these are 2024 addresses in hosting ranges and may have been reassigned, in which case a match describes an unrelated site. Do not treat a match as current DarkMe or Griffith activity without fresh corroboration.
highdarkme-griffith-2026-09othermatches by queryadded 2026-09-17
Scanned pages that sent requests to a domain published for the December 2023 to February 2024 DarkMe campaign reported by Trend Micro as Water Hydra (CVE-2024-21412): fxbulls.ru (delivery website), unfawjelesst322.com (command and control), and 87iavv.com and p2oaviwt39ui.com (campaign indicators, role not established). This hunt covers a page that contacts the infrastructure; a companion hunt covers scans of the infrastructure itself. Only requests observed during the scan count. A link that was never followed, or an article that quotes these domains, does not match. These indicators are historical. Current ownership and activity have not been verified, so a match is a lead for review, not evidence that a site is malicious today. Virus Bulletin groups the DarkMe family with GriffithRAT under the Griffith intrusion set, but these indicators establish a DarkMe association only, not Griffith attribution.
highbluemoon-shadowpad-2026-09othermatches by queryadded 2026-09-12
Generalizing tripwire, not an IoC: ShadowPad C2 servers in this campaign present SELF-SIGNED TLS certificates whose subject organization impersonates a major brand. This catches infrastructure without a published indicator. Based on Proofpoint's "Once in a BlueMoon" report (2026-09).
highbluemoon-shadowpad-2026-09othermatches by queryadded 2026-09-12
Second half of the look-alike domain set against real aerospace/defence/industrial brands. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).
highbluemoon-shadowpad-2026-09othermatches by queryadded 2026-09-12
Lookalike domains registered by the actor against real aerospace/defence/industrial brands on cheap TLDs (.fit .ink .lol .online .site). Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).
criticalrcfh-aitm-storm2755phishingmatches by YARA + queryadded 2026-08-10
The older, pre-rotation naming generation of the same AiTM authentication proxy: seven .digital domains built from generic corporate-sounding compounds, several with a hyphen inserted mid-word to dodge string matching (wisemediapa-ttern, xsyst-emsquantum, tec-hnoplatform2025). Arctic Wolf tied these back to the toolkit because they exposed the same /st_58200519/class_identifier.php fingerprinting path as the current 'ms'-labelled generation, despite sharing none of its naming conventions. All were reported defunct as of 2026-07-30.
mediumrcfh-aitm-storm2755phishingmatches by queryadded 2026-08-10
The seven Hostinger addresses that served the published redirectors and AiTM proxies. Redirectors: 187.124.129.44 (idp.keyreniao.com), 194.5.157.204 (idp.korminel.com), 145.223.100.123 (idp.kualabemo.com). Proxies: 153.92.1.166 (mslogin.milocaroline.com), 31.97.76.103 (msauth.monlinelogicaline.com), 177.7.56.248 (msonline.logicalineonline.com), 72.62.0.181 (office.ofreace.com and office.ofercarc.com, two proxies co-located).
criticalaitm-proxy-url-rewritephishingmatches by YARAadded 2026-08-10
Toolkit-agnostic detection for the structural artefact every Evilginx-style AiTM proxy leaves behind. A real AiTM relay does not clone the Microsoft sign-in page — it forwards the genuine flow and rewrites the URLs in the response, so Microsoft's own endpoints end up embedded in the PATH of the attacker's origin: https://<attacker>/https://login.microsoftonline.com/common/GetCredentialType, .../common/login, .../common/SAS/BeginAuth, .../common/SAS/EndAuth. Because the page is the real Microsoft page, brand-similarity, favicon, screenshot-hash and OCR checks all agree it looks legitimate — which is exactly why the rewriting artefact, rather than the page's appearance, is the thing to key on.
criticalrcfh-aitm-storm2755phishingmatches by YARA + queryadded 2026-08-10
Adversary-in-the-middle credential/session theft feeding payroll-diversion BEC, overlapping the cluster Microsoft tracks as Storm-2755. Chain: voicemail-themed mail with subject '[Organization] :ATTN: Review messages. Ref id: [random]' -> redirect laundered through Google Meet linkredirect, Google Ads /ddm/clk/ click trackers and an S3 intermediary -> an 'idp.'-labelled Apache redirector 302s to the AiTM proxy -> the proxy bounces the victim once to /st_58200519/class_identifier.php to fingerprint the browser and cache a country code in an rcfh_country cookie -> the proxy relays the genuine login.microsoftonline.com flow, rewriting Microsoft's endpoints into its own path, and captures the authorization code and ID token at its callback. Post-compromise the actor signs in from residential proxies on an eight-hour cadence keeping one SessionID across ASNs, enumerates payroll/HR/finance staff over Microsoft Graph with an axios/1.18.1 user agent, and reads mail on payroll, invoices, banking and benefits.
highprove-financial-framework-202608phishingmatches by YARA + queryadded 2026-08-07
Shared phishing framework documented by urlscan 2026-08-04, deployed against deliberately LOW-PROFILE financial and identity brands rather than megabrands: Prove (identity verification), US Bank SinglePoint, AMINA E-Banking, Currency Cloud, Pleo, Slim CD, PayMongo, Aspire. Cloudflare-fronted, several hosts sharing a nameserver pair. Anchored on the kit-unique global __panelFrontsDevtoolsTrapStarted__ (a devtools-detection-trap guard) — a framework identifier coded into the kit logic, so it survives host rotation and minification, unlike IP/domain/hash IoCs.
