-
T1098.005 · persistence · experimental · level high · okta · 2026-09-12
Enrollment or activation of an Okta MFA authenticator from a virtual-machine guest, the persistence step of the ShinyHunters "The Com" claims campaign. Once the operator has relayed a live session, a captured session is transient, so they bind their own Okta Verify device to the account — access that is independent of the victim's phone and survives a password reset.
-
T1111 · credential access · experimental · level medium · okta · 2026-09-12
An Okta authentication or MFA event whose client connection is flagged as a remote-desktop, proxy, or Tor tunnel — the network origin of the adversary-in-the-middle relay in the ShinyHunters "The Com" claims campaign. In the live flow the victim is on the phone and on a phishing page, but the credential replay and MFA completion the genuine Okta tenant records come from the operator's own infrastructure, typically a hosting or remote-desktop ASN rather than the user's network.
-
T1027.013 · credential access · experimental · level high · proxy · 2026-09-12
The client-to-server channel of the ShinyHunters "The Com" claims-impersonation kit. Unlike the Telegram-relay kits that dominate this ecosystem, this variant exfiltrates first-party: captured credentials and MFA codes are POSTed to the kit's own origin over a compact set of single-letter routes (/e login and OTP, /w captcha returning the panel type, /z operator status, plus /d /y /m /u /x), with bodies sent as Content-Type text/plain carrying the header X-Enc: 1 and a base64 payload.
-
T1557 · credential access · experimental · level high · proxy · 2026-09-12
A web request retrieving the Okta Verify authenticator icon (oktaverify.svg) from any host that is not Okta. The ShinyHunters "The Com" claims-impersonation kit self-hosts the Okta brand assets it clones, including this SVG, so the file is served from the lookalike domain rather than from Okta's own content-delivery infrastructure.
-
T1036.005 · credential access · experimental · level high · proxy · 2026-09-12
The anti-analysis gate of the ShinyHunters "The Com" claims-impersonation kit loads a real Cloudflare Turnstile widget while presenting the victim a pixel-clone of Google reCAPTCHA; the live Turnstile element is mounted over the fake reCAPTCHA at 1% opacity so the victim clicks what looks like "I'm not a robot" from Google and actually solves Turnstile. In the reversed build the kit injects Turnstile via a script tag whose onload callback is the distinctive "__onTurnstileReady", loaded from challenges.cloudflare.com, on a page that is simultaneously serving a cloned Okta login (see the companion oktaverify.svg rule).
-
T1566.004 · resource development · experimental · level medium · dns · 2026-09-12
DNS resolution of a domain matching the ShinyHunters "The Com" claims-impersonation campaign naming grammar — a victim brand rendered as <brand>.claims, <brand>-claims.com, claims-<brand>.com, or us-<brand>.com. The campaign registers these through Dynadot, fronts them with Cloudflare, and provisions a same-day Google Trust Services certificate with no MX record; the network-observable tail of that acquired infrastructure is a client resolving the name.
-
T1055 · defense evasion · experimental · level high · process_creation/windows · 2026-08-14
A rundll32.exe process spawning explorer.exe. Observed as the injection stage of a ClickFix-delivered loader: rundll32 runs the staged DLL (rundll32 <dll>,Run), which starts a fresh SysWOW64\explorer.exe purely as an injection host and writes its next stage into that process memory.
-
T1071.004 · command and control · experimental · level medium · network_connection/windows · 2026-08-14
A process that is not a browser or a sanctioned resolver connecting to a public DNS-over-HTTPS provider on 443. Observed as the C2 name-resolution stage of an infostealer: the injected process resolved its command-and-control domain through dns.google over HTTPS so the lookup never appears in plaintext DNS a defender can inspect, then beaconed TLS to a freshly registered, Cloudflare-fronted domain.
-
T1574.002 · defense evasion · experimental · level high · image_load/windows · 2026-08-14
The legitimate Oracle Java compiler launcher javac.exe loading jli.dll from a user-writable directory such as %TEMP% or %APPDATA%. javac.exe imports jli.dll (JLI_Launch) by name and resolves it by DLL search order from its own directory, so dropping a malicious jli.dll beside a copy of the signed javac.exe executes attacker code inside a trusted, signed host — classic search-order side-loading.
-
T1102.001 · command and control · experimental · level high · proxy · 2026-08-11
Browser retrieving second-stage JavaScript from smart contracts on BNB Smart Chain testnet (chainId 97). Observed 2026-08-11 in a live compromise of a high-traffic US consumer site, where a rogue Google Tag Manager container injected an obfuscated loader that issued eth_call with selector 0x6d4ce63c (get()) against attacker-owned contracts and passed the ABI-decoded string to eval(atob(...)).
-
T1195.002 · initial access · experimental · level high · proxy · 2026-08-11
Retrieval of Google Tag Manager container GTM-PJB7D937 from googletagmanager.com. Observed 2026-08-11 loading on a high-traffic US consumer site alongside the three legitimate containers belonging to that site.
-
T1204.004 · execution · experimental · level high · process_creation/macos · 2026-08-11
Shell spawned by Terminal.app (or another macOS terminal emulator) running a pipe-to-shell or base64-decode-to-shell one-liner, which is the macOS branch of a ClickFix lure. The counterfeit reCAPTCHA instructs the victim to open Terminal from Applications -> Utilities, press Command+V against a clipboard the page has already poisoned, and press Enter.
-
T1105 · execution · experimental · level high · process_creation/windows · 2026-08-11
Terminal execution stage of a ClickFix lure, where the victim pastes an attacker command into the Windows Run dialog and the resulting process descends from explorer.exe rather than from a browser. Three conditions are matched, any one of which is sufficient.
-
T1037 · persistence · experimental · level medium · file_event/linux · 2026-06-11
Creation or modification of legacy init-system entry points (/etc/rc.local, /etc/init.d/, /etc/rc*.d/). Adversaries plant scripts there for root-context execution at boot — old-school, still routinely effective on servers and appliances that keep sysvinit compatibility.
-
T1098.004 · persistence · experimental · level medium · file_event/linux · 2026-06-11
Creation or modification of an SSH authorized_keys file. Adversaries add their own public key to maintain persistent access after initial compromise — a one-line write that survives credential rotation and (on many estates) every patch cycle.
-
T1566.002 · initial access · experimental · level medium · sms/mobile · 2026-06-10
Smishing campaign targeting hotel customers in Luxembourg. The CIRCL MISP event lists six SMS sender phone numbers (NL/UK/ID country codes) that delivered the lure linking to a credential-harvesting page.
Every rule publishes with its live intel context — the KEV CVEs, EPSS scores and family activity that justified authoring it. Rules ship as Sigma YAML, TLP:CLEAR, CC BY 4.0. The desk →