title: 'T1557 Okta Verify SVG Asset Served by a Non-Okta Host'
id: '01e19e36-08d8-4fbc-a142-c0a7be74d8c8'
status: 'experimental'
description: 'A web request retrieving the Okta Verify authenticator icon (oktaverify.svg) from any host that is not Okta. The ShinyHunters "The Com" claims-impersonation kit self-hosts the Okta brand assets it clones, including this SVG, so the file is served from the lookalike domain rather than from Okta''s own content-delivery infrastructure. A host that is not Okta has no legitimate reason to serve Okta''s authenticator icon, which gives this signature effectively no benign baseline; it is close to zero-false-positive and inline-blockable at the proxy. It is also domain-independent and rotation-proof: the kit re-registers and re-hashes its domains and bundles per deployment, but it continues to self-host the same named brand assets, so the filename survives every infrastructure change the operator makes. This is the highest-fidelity on-visit signal in the detection set and fires before credentials are entered.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.collection'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_asset:
        cs-uri-stem|endswith: '/oktaverify.svg'
    filter_legit_okta:
        cs-host|endswith:
            - '.okta.com'
            - '.oktacdn.com'
            - '.okta-emea.com'
            - '.oktapreview.com'
            - '.okta.mil'
            - '.okta-gov.com'
    condition: 'selection_asset and not filter_legit_okta'
falsepositives:
    - 'Internal mirrors, staging environments, or documentation portals that legitimately cache Okta brand assets under a corporate host. Allowlist the specific internal hosts rather than removing the filter.'
    - 'Phishing-simulation platforms that clone Okta login pages for authorized awareness testing. Exclude the sanctioned simulation vendor domains.'
    - 'Security or brand-protection tooling that fetches and archives phishing page assets. Exclude the tooling egress.'
level: 'high'