Most Important ShinyHunters 2026: Lookalike SSO Phishing Domain Correlation with Vishing-Driven Authentication Events
Detects a correlation between a DNS query for a potential typosquatting or brand-lookalike domain (newly observed within the last 30 days) and a subsequent sign-in authentication event originating from the same client IP within a 30-minute window. This behavior is indicative of an attacker, such as ShinyHunters vishing operators, directing victims to a lookalike SSO phishing portal to harvest credentials and MFA tokens before attempting access to the legitimate environment.
Microsoft Sentinel (KQL)
