T1557 Okta Verify SVG Asset Served by a Non-Okta Host

A web request retrieving the Okta Verify authenticator icon (oktaverify.svg) from any host that is not Okta. The ShinyHunters "The Com" claims-impersonation kit self-hosts the Okta brand assets it clones, including this SVG, so the file is served from the lookalike domain rather than from Okta's own content-delivery infrastructure. A host that is not Okta has no legitimate reason to serve Okta's authenticator icon, which gives this signature effectively no benign baseline; it is close to zero-false-positive and inline-blockable at the proxy. It is also domain-independent and rotation-proof: the kit re-registers and re-hashes its domains and bundles per deployment, but it continues to self-host the same named brand assets, so the filename survives every infrastructure change the operator makes. This is the highest-fidelity on-visit signal in the detection set and fires before credentials are entered.

Intel context

This detection responds to live corpus signal — the intel below is what its ATT&CK technique is exercising right now (recomputed September 18, 2026).

Technique	KEV CVEs	OSINT cites	Active families
T1557 Adversary-in-the-Middle	4	0	—

KEV CVEs mapped to this technique

Known-exploited vulnerabilities MITRE attributes to this ATT&CK technique — not necessarily to this specific campaign. They establish that the technique is under active exploitation, which is why a detection for it is worth authoring.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2022-1040	Sophos / Firewall	0.998	—
CVE-2025-31200	Apple / Multiple Products	0.186	—
CVE-2019-5591	Fortinet / FortiOS	0.184	ransomware
CVE-2025-31201	Apple / Multiple Products	0.139	—

Rule ID: 01e19e36-08d8-4fbc-a142-c0a7be74d8c8
Status: experimental
Level: high
Log source: category: proxy
Date: 2026-09-12
Modified: 2026-09-12
ATT&CK: T1557 (signal rollup)
Canonical YAML: t1557-non-okta-host-oktaverify-svg.yml

References

False positives

Internal mirrors, staging environments, or documentation portals that legitimately cache Okta brand assets under a corporate host. Allowlist the specific internal hosts rather than removing the filter.
Phishing-simulation platforms that clone Okta login pages for authorized awareness testing. Exclude the sanctioned simulation vendor domains.
Security or brand-protection tooling that fetches and archives phishing page assets. Exclude the tooling egress.

Rule YAML

title: 'T1557 Okta Verify SVG Asset Served by a Non-Okta Host'
id: '01e19e36-08d8-4fbc-a142-c0a7be74d8c8'
status: 'experimental'
description: 'A web request retrieving the Okta Verify authenticator icon (oktaverify.svg) from any host that is not Okta. The ShinyHunters "The Com" claims-impersonation kit self-hosts the Okta brand assets it clones, including this SVG, so the file is served from the lookalike domain rather than from Okta''s own content-delivery infrastructure. A host that is not Okta has no legitimate reason to serve Okta''s authenticator icon, which gives this signature effectively no benign baseline; it is close to zero-false-positive and inline-blockable at the proxy. It is also domain-independent and rotation-proof: the kit re-registers and re-hashes its domains and bundles per deployment, but it continues to self-host the same named brand assets, so the filename survives every infrastructure change the operator makes. This is the highest-fidelity on-visit signal in the detection set and fires before credentials are entered.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.collection'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_asset:
        cs-uri-stem|endswith: '/oktaverify.svg'
    filter_legit_okta:
        cs-host|endswith:
            - '.okta.com'
            - '.oktacdn.com'
            - '.okta-emea.com'
            - '.oktapreview.com'
            - '.okta.mil'
            - '.okta-gov.com'
    condition: 'selection_asset and not filter_legit_okta'
falsepositives:
    - 'Internal mirrors, staging environments, or documentation portals that legitimately cache Okta brand assets under a corporate host. Allowlist the specific internal hosts rather than removing the filter.'
    - 'Phishing-simulation platforms that clone Okta login pages for authorized awareness testing. Exclude the sanctioned simulation vendor domains.'
    - 'Security or brand-protection tooling that fetches and archives phishing page assets. Exclude the tooling egress.'
level: 'high'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1557-non-okta-host-oktaverify-svg.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.