rule bulwark_https_bulwarkblack_com_unc6671_helpdesk_vishing_cloud_data_theft
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/unc6671-helpdesk-vishing-cloud-data-theft/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-10T15:05:30Z"
        tlp = "TLP:CLEAR"
        indicator_count = "90"
    strings:
        $s0 = "0811A9866E.com" ascii wide nocase  // Domains
        $s1 = "Pipe.ma" ascii wide nocase  // Domains
        $s2 = "PublicDomainRegistry.com" ascii wide nocase  // Domains
        $s3 = "activatemypasskey.com" ascii wide nocase  // Domains
        $s4 = "activatepasskey.com" ascii wide nocase  // Domains
        $s5 = "activatepasskeyportal.com" ascii wide nocase  // Domains
        $s6 = "add-passkey.com" ascii wide nocase  // Domains
        $s7 = "addmypasskey.com" ascii wide nocase  // Domains
        $s8 = "addoktapasskey.com" ascii wide nocase  // Domains
        $s9 = "addpasskey2fa.com" ascii wide nocase  // Domains
        $s10 = "addssopasskey.com" ascii wide nocase  // Domains
        $s11 = "addyourpasskey.com" ascii wide nocase  // Domains
        $s12 = "assignpasskey.com" ascii wide nocase  // Domains
        $s13 = "checkpasskey.com" ascii wide nocase  // Domains
        $s14 = "createmfa.com" ascii wide nocase  // Domains
        $s15 = "createmypasskey.com" ascii wide nocase  // Domains
        $s16 = "createpasskey.com" ascii wide nocase  // Domains
        $s17 = "createssopasskey.com" ascii wide nocase  // Domains
        $s18 = "deploypasskey.com" ascii wide nocase  // Domains
        $s19 = "enablepasskey.com" ascii wide nocase  // Domains
        $s20 = "enablepasskey2fa.com" ascii wide nocase  // Domains
        $s21 = "enrollpasskey.com" ascii wide nocase  // Domains
        $s22 = "hubpasskey.com" ascii wide nocase  // Domains
        $s23 = "idokta.com" ascii wide nocase  // Domains
        $s24 = "keyokta.com" ascii wide nocase  // Domains
        $s25 = "keysyncos.com" ascii wide nocase  // Domains
        $s26 = "makepasskey.com" ascii wide nocase  // Domains
        $s27 = "mspasskey.com" ascii wide nocase  // Domains
        $s28 = "myaccountsecurity.com" ascii wide nocase  // Domains
        $s29 = "myconnectkey.com" ascii wide nocase  // Domains
        $s30 = "mynewpasskey.com" ascii wide nocase  // Domains
        $s31 = "myoktasso.com" ascii wide nocase  // Domains
        $s32 = "mypasskeyid.com" ascii wide nocase  // Domains
        $s33 = "mypasskeysso.com" ascii wide nocase  // Domains
        $s34 = "mysecurepasskey.com" ascii wide nocase  // Domains
        $s35 = "myssopasskey.com" ascii wide nocase  // Domains
        $s36 = "newpasskey.com" ascii wide nocase  // Domains
        $s37 = "oktaenroll.com" ascii wide nocase  // Domains
        $s38 = "oktaportalsso.com" ascii wide nocase  // Domains
        $s39 = "oskeyconnect.com" ascii wide nocase  // Domains
        $s40 = "oskeysync.com" ascii wide nocase  // Domains
        $s41 = "passkey-check.com" ascii wide nocase  // Domains
        $s42 = "passkey-connect.com" ascii wide nocase  // Domains
        $s43 = "passkey-enable.com" ascii wide nocase  // Domains
        $s44 = "passkey-portal.com" ascii wide nocase  // Domains
        $s45 = "passkey-setup.com" ascii wide nocase  // Domains
        $s46 = "passkeyactivation.com" ascii wide nocase  // Domains
        $s47 = "passkeyadd.com" ascii wide nocase  // Domains
        $s48 = "passkeycenter.com" ascii wide nocase  // Domains
        $s49 = "passkeycreate.com" ascii wide nocase  // Domains
        $s50 = "passkeycreator.com" ascii wide nocase  // Domains
        $s51 = "passkeydeploy.com" ascii wide nocase  // Domains
        $s52 = "passkeyenable.com" ascii wide nocase  // Domains
        $s53 = "passkeyenroll.com" ascii wide nocase  // Domains
        $s54 = "passkeyhelpdesk.com" ascii wide nocase  // Domains
        $s55 = "passkeymfa.com" ascii wide nocase  // Domains
        $s56 = "passkeyms.com" ascii wide nocase  // Domains
        $s57 = "passkeyokta.com" ascii wide nocase  // Domains
        $s58 = "passkeyportal.com" ascii wide nocase  // Domains
        $s59 = "passkeyportalsetup.com" ascii wide nocase  // Domains
        $s60 = "passkeyregister.com" ascii wide nocase  // Domains
        $s61 = "passkeyregistration.com" ascii wide nocase  // Domains
        $s62 = "passkeyrollout.com" ascii wide nocase  // Domains
        $s63 = "passkeyset.com" ascii wide nocase  // Domains
        $s64 = "passkeystatus.com" ascii wide nocase  // Domains
        $s65 = "passkeysupport.com" ascii wide nocase  // Domains
        $s66 = "passkeyuser.com" ascii wide nocase  // Domains
        $s67 = "portalpasskey.com" ascii wide nocase  // Domains
        $s68 = "portalsetuphub.com" ascii wide nocase  // Domains
        $s69 = "registerpasskey.com" ascii wide nocase  // Domains
        $s70 = "secure-passkey.com" ascii wide nocase  // Domains
        $s71 = "secureauthpasskey.com" ascii wide nocase  // Domains
        $s72 = "setpasskey.com" ascii wide nocase  // Domains
        $s73 = "setupsso.com" ascii wide nocase  // Domains
        $s74 = "setupssopasskey.com" ascii wide nocase  // Domains
        $s75 = "sqfepjvmrd.xyz" ascii wide nocase  // Domains
        $s76 = "ssopasskey.com" ascii wide nocase  // Domains
        $s77 = "startpasskey.com" ascii wide nocase  // Domains
        $s78 = "startpasskeysetup.com" ascii wide nocase  // Domains
        $s79 = "107.128.45.122" ascii wide nocase  // IPv4
        $s80 = "185.178.208.153" ascii wide nocase  // IPv4
        $s81 = "193.34.212.132" ascii wide nocase  // IPv4
        $s82 = "195.140.213.114" ascii wide nocase  // IPv4
        $s83 = "195.140.213.115" ascii wide nocase  // IPv4
        $s84 = "23.234.75.84" ascii wide nocase  // IPv4
        $s85 = "31.7.56.52" ascii wide nocase  // IPv4
        $s86 = "31.7.56.61" ascii wide nocase  // IPv4
        $s87 = "38.42.59.171" ascii wide nocase  // IPv4
        $s88 = "47.218.103.146" ascii wide nocase  // IPv4
        $s89 = "76.103.148.180" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}