DNS/TLS Query to Storm-3121/3032 Passkey Phishing Domains

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detection of DNS queries, TLS SNI, and HTTP Host headers matching domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns mimic identity, SSO, and passkey registration processes to capture credentials or perform token theft.