UNC6671 Vishing Campaign - Lookalike Passkey/SSO Enrollment Domain Query

Duo Tech@duotech

•updated Aug 9, 2026•11•0•20

Detects DNS queries to UNC6671 vishing-lure lookalike domains (createssopasskey/addssopasskey/passkeyhelpdesk) used to harvest credentials after a helpdesk-impersonation vishing call.