Date: 08/28/2026
Severity: High
Summary
A recently identified domain, passkeyconnect[.]com, is likely linked to Com-affiliated threat actors, including Bling Libra and CL-CRI-1116, based on known infrastructure fingerprints. Analysis identified 20+ organizations across 11 industries that could be targeted in vishing campaigns based on previously observed activity. Targeted sectors include financial services, healthcare, technology, hospitality, insurance, manufacturing, pharma, real estate, transportation, and energy. Notably, this is the first observed use of a previously existing domain, which was re-registered via NiceNIC on August 20, 2026, after its original creation on March 5, 2023.
Indicators of Compromise (IOC) List
Domains/URLs | mfa-passkey.com new-passkey.com apply-passkey.com mfapasskeysetup.com confirmpasskey.com startmypasskey.com verify-passkey.com onboardpasskey.com mypasskeyapp.com fastpasskeys.com enrollssopasskey.com enroll-passkey.com passkeyconnect.com deploypasskeys.com register-passkey.com mypasskeyapps.com myapps2fa.com my-passkey.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "confirmpasskey.com" or url like "confirmpasskey.com" or siteurl like "confirmpasskey.com" or domainname like "verify-passkey.com" or url like "verify-passkey.com" or siteurl like "verify-passkey.com" or domainname like "onboardpasskey.com" or url like "onboardpasskey.com" or siteurl like "onboardpasskey.com" or domainname like "enrollssopasskey.com" or url like "enrollssopasskey.com" or siteurl like "enrollssopasskey.com" or domainname like "mfa-passkey.com" or url like "mfa-passkey.com" or siteurl like "mfa-passkey.com" or domainname like "deploypasskeys.com" or url like "deploypasskeys.com" or siteurl like "deploypasskeys.com" or domainname like "mfapasskeysetup.com" or url like "mfapasskeysetup.com" or siteurl like "mfapasskeysetup.com" or domainname like "new-passkey.com" or url like "new-passkey.com" or siteurl like "new-passkey.com" or domainname like "startmypasskey.com" or url like "startmypasskey.com" or siteurl like "startmypasskey.com" or domainname like "passkeyconnect.com" or url like "passkeyconnect.com" or siteurl like "passkeyconnect.com" or domainname like "register-passkey.com" or url like "register-passkey.com" or siteurl like "register-passkey.com" or domainname like "apply-passkey.com" or url like "apply-passkey.com" or siteurl like "apply-passkey.com" or domainname like "mypasskeyapps.com" or url like "mypasskeyapps.com" or siteurl like "mypasskeyapps.com" or domainname like "my-passkey.com" or url like "my-passkey.com" or siteurl like "my-passkey.com" or domainname like "myapps2fa.com" or url like "myapps2fa.com" or siteurl like "myapps2fa.com" or domainname like "mypasskeyapp.com" or url like "mypasskeyapp.com" or siteurl like "mypasskeyapp.com" or domainname like "enroll-passkey.com" or url like "enroll-passkey.com" or siteurl like "enroll-passkey.com" or domainname like "fastpasskeys.com" or url like "fastpasskeys.com" or siteurl like "fastpasskeys.com" |
Reference:
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-08-27-New-Passkey-Themed-Subdomains-Target-Numerous-Industries.txt