All Detections

UNC6671 cloned SSO/vault-drainer panel fingerprinted asset request

avatar
Duo Tech@duotech
updated Aug 9, 2026309

Detects HTTP requests for fingerprinted JavaScript/CSS assets shared across UNC6671's cloned SSO and cryptocurrency vault-drainer phishing panels.

Suricata