T1557 Okta Verify SVG Asset Served by a Non-Okta Host

A web request retrieving the Okta Verify authenticator icon (oktaverify.svg) from any host that is not Okta. The ShinyHunters "The Com" claims-impersonation kit self-hosts the Okta brand assets it clones, including this SVG, so the file is served from the lookalike domain rather than from Okta's own content-delivery infrastructure. A host that is not Okta has no legitimate reason to serve Okta's authenticator icon, which gives this signature effectively no benign baseline; it is close to zero-false-positive and inline-blockable at the proxy. It is also domain-independent and rotation-proof: the kit re-registers and re-hashes its domains and bundles per deployment, but it continues to self-host the same named brand assets, so the filename survives every infrastructure change the operator makes. This is the highest-fidelity on-visit signal in the detection set and fires before credentials are entered.

Intel context

The technique this rule covers is in use. This is the evidence for it as of November 7, 2026.

Technique	KEV CVEs	Research, 90d	Active families
T1557 Adversary-in-the-Middle	4	7	—

KEV CVEs mapped to this technique

CVEs in CISA KEV that MITRE maps to this technique. They may belong to other campaigns. They show the technique is in use.

CVE	Vendor / Product	EPSS	Ransomware
CVE-2022-1040	Sophos / Firewall	0.998	—
CVE-2025-31200	Apple / Multiple Products	0.209	—
CVE-2019-5591	Fortinet / FortiOS	0.186	ransomware
CVE-2025-31201	Apple / Multiple Products	0.140	—

Research citing this technique

2026-11-04 · ESET SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
2026-10-30 · Microsoft Threat Intelligence From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
2026-10-29 · Cisco Talos IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-22 · Huntress M365 Token Spray and Replay Campaign Compromises Business Email Accounts
2026-09-02 · Huntress Inside Knight Office, a New M365 AiTM Phishing Kit

Rule ID: 01e19e36-08d8-4fbc-a142-c0a7be74d8c8
Status: experimental
Level: high
Log source: category: proxy
Date: 2026-09-12
Modified: 2026-09-12
ATT&CK: T1557 (signal rollup)
Canonical YAML: t1557-non-okta-host-oktaverify-svg.yml

References

False positives

Internal mirrors, staging environments, or documentation portals that legitimately cache Okta brand assets under a corporate host. Allowlist the specific internal hosts rather than removing the filter.
Phishing-simulation platforms that clone Okta login pages for authorized awareness testing. Exclude the sanctioned simulation vendor domains.
Security or brand-protection tooling that fetches and archives phishing page assets. Exclude the tooling egress.

Rule YAML

title: 'T1557 Okta Verify SVG Asset Served by a Non-Okta Host'
id: '01e19e36-08d8-4fbc-a142-c0a7be74d8c8'
status: 'experimental'
description: 'A web request retrieving the Okta Verify authenticator icon (oktaverify.svg) from any host that is not Okta. The ShinyHunters "The Com" claims-impersonation kit self-hosts the Okta brand assets it clones, including this SVG, so the file is served from the lookalike domain rather than from Okta''s own content-delivery infrastructure. A host that is not Okta has no legitimate reason to serve Okta''s authenticator icon, which gives this signature effectively no benign baseline; it is close to zero-false-positive and inline-blockable at the proxy. It is also domain-independent and rotation-proof: the kit re-registers and re-hashes its domains and bundles per deployment, but it continues to self-host the same named brand assets, so the filename survives every infrastructure change the operator makes. This is the highest-fidelity on-visit signal in the detection set and fires before credentials are entered.'
references:
    - 'https://thrunt.me/research/2026-09-12-claims-kit-recaptcha-turnstile-xor-exfil/'
    - 'https://attack.mitre.org/techniques/T1557/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-09-12'
modified: '2026-09-12'
tags:
    - 'attack.credential_access'
    - 'attack.t1557'
    - 'attack.collection'
    - 'tlp.clear'
logsource:
    category: 'proxy'
detection:
    selection_asset:
        cs-uri-stem|endswith: '/oktaverify.svg'
    filter_legit_okta:
        cs-host|endswith:
            - '.okta.com'
            - '.oktacdn.com'
            - '.okta-emea.com'
            - '.oktapreview.com'
            - '.okta.mil'
            - '.okta-gov.com'
    condition: 'selection_asset and not filter_legit_okta'
falsepositives:
    - 'Internal mirrors, staging environments, or documentation portals that legitimately cache Okta brand assets under a corporate host. Allowlist the specific internal hosts rather than removing the filter.'
    - 'Phishing-simulation platforms that clone Okta login pages for authorized awareness testing. Exclude the sanctioned simulation vendor domains.'
    - 'Security or brand-protection tooling that fetches and archives phishing page assets. Exclude the tooling egress.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1557-non-okta-host-oktaverify-svg.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.