AiTM lookalike proxy embedding login.microsoftonline.com OAuth authorize path

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•0

This rule set detects multi-stage network patterns indicative of AiTM phishing campaigns. It identifies common redirection techniques, including lookalike domains hosting Microsoft OAuth authorize URLs, DNS resolution of Google ad-tech infrastructure followed by novel domains, malicious use of Google Meet and Google Ads click-tracking endpoints as phishing hops, and references to AWS S3-hosted intermediate landing pages.