UNC6671 passkey/SSO themed credential-harvesting domain query burst

Duo Tech@duotech

•updated Aug 7, 2026•0•0•6

Detects DNS query bursts from a single source to a predefined set of domains mimicking passkey or single-sign-on (SSO) login portals. These domains are known to be part of the infrastructure used by the UNC6671 threat actor for credential harvesting activities.