Lookalike phishing subdomain impersonating Okta/M365 login (AiTM relay)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•1

Detects outbound network traffic attempting to access lookalike subdomains mimicking Okta or Microsoft 365 identity provider login pages. This behavior is associated with adversary-in-the-middle (AiTM) phishing campaigns, such as those attributed to UNC6671, where attackers use spoofed infrastructure to capture user credentials and session tokens.