Early infrastructure warning blocked a Scattered Lapsus attack

At a glance

What this is: Silent Push describes how early detection of adversary infrastructure helped a Fortune 500 media company block a Scattered Lapsus ShinyHunters social engineering campaign before the second attempt reached an employee.

Why it matters: It matters because SOC and identity teams need controls that see staged attacker infrastructure before credential-harvesting flows go live, not only after compromise evidence appears.

By the numbers:

• Silent Push flagged the domain 24 hours before the attack launched.

Context

Threat actors that rely on social engineering often stage supporting infrastructure before they contact a target, which means conventional detection can arrive too late. The security gap is not only the malicious domain itself, but the window between infrastructure being built and the campaign being used.

This article is also an identity story because the lure impersonated a passkey authentication flow, aiming to capture trust at the point where users expect to authenticate. That makes the problem one of identity deception as much as network defense, especially when adversary infrastructure changes faster than historical threat feeds.

For SOC teams, the typical failure mode is relying on indicators of compromise after the fact rather than indicators of future attack before the event. That distinction is central here because the defender’s usable window existed before the first user interaction.

Key questions

Q: What fails when security teams rely only on indicators of compromise for phishing defence?

A: They lose the chance to stop the campaign before it reaches users. Indicators of compromise usually arrive after an event is already underway or complete, while staged infrastructure can be blocked earlier if teams watch for pre-launch domain and hosting patterns. That shifts control from evidence collection to preventive enforcement.

Q: Why does a fake passkey login flow create more risk than a generic phishing page?

A: It targets a trusted authentication moment, which makes the lure more convincing and more likely to bypass user suspicion. When attackers mimic modern sign-in experiences, they can turn identity trust into an attack surface. That is why verification of the domain and the surrounding infrastructure matters as much as the page itself.

Q: What are the signs that adversary infrastructure is being staged before a campaign goes live?

A: Look for newly registered or newly active domains, clustered hosting patterns, short-lived redirect infrastructure, and infrastructure that appears in the environment before any confirmed compromise. Those signals are most useful when they can be tied to a campaign and pushed into blocking controls before user interaction begins.

Q: Should SOC teams block a single malicious domain or the broader infrastructure cluster?

A: The broader infrastructure cluster is the better target when the evidence supports it. A single domain block can be bypassed with a second lure, but cluster-level mapping lets teams contain the campaign rather than the first contact point. That improves resilience against fast-moving social engineering operations.

Technical breakdown

Indicators of future attack versus indicators of compromise

Indicators of compromise describe artefacts left after malicious activity has already occurred. Indicators of future attack, by contrast, are infrastructure signals that appear while an adversary is staging domains, hosting, redirects, and related assets before launch. That matters because bulletproof hosting and short-lived lookalike domains can disappear quickly once a campaign is exposed. The operational value lies in pre-incident visibility, where blocking decisions can be made on infrastructure posture rather than post-breach evidence. In this case, the domain had already been tagged before the call was placed, which changed the defender’s response window from forensic to preventive.

Practical implication: Treat pre-attack infrastructure signals as blocking inputs, not just threat-intelligence context.

Lookalike domains and passkey impersonation

A lookalike domain works by copying the visual cues and workflow expectations of a legitimate login flow so the user accepts the interaction as routine. When the lure imitates passkey authentication, the attacker is not merely stealing a password. They are exploiting user trust in a modern authentication ceremony, which can bypass older detection patterns that focus on password spray or credential stuffing. The identity control failure is not only authentication strength. It is the absence of domain-level verification and user awareness when the authentication surface itself is being spoofed.

Practical implication: Harden authentication journeys with domain verification and user-side reporting paths for suspicious login flows.

Why full campaign mapping matters to firewall control

Blocking one domain is often insufficient when the adversary has already staged multiple related assets. Campaign infrastructure can include several lookalike domains, redirectors, and hosting nodes, and the attacker may pivot to a second lure within minutes. Full mapping lets defenders push a broader block decision into network enforcement, reducing the chance that the campaign resumes through a different endpoint. That is especially important in identity-targeted attacks, where the attacker only needs one successful interaction to create downstream compromise. Here, the ability to enumerate the cluster changed the firewall from a point fix into campaign containment.

Practical implication: Expand from single-IOC blocking to infrastructure cluster blocking tied to campaign-level monitoring.

Threat narrative

Attacker objective: The objective was to exploit identity trust and harvest access through a social-engineering-led authentication lure that could open the door to broader compromise.

1. Entry began with a staged lookalike domain impersonating a passkey authentication flow and a phone call directed at an employee.
2. Credential harvesting pressure came from social engineering around the fake login journey, which was meant to elicit trust and interaction rather than malware execution.
3. Impact was prevented when the first domain was blocked, the related infrastructure was mapped, and a second attempt was stopped before it reached another employee.

Breaches seen in the wild

• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Pre-attack infrastructure visibility is now a governance requirement, not a niche hunting technique. When adversary domains are staged before use, the effective control point moves earlier than traditional IOC-driven response. Security teams that only consume post-compromise indicators are structurally late against short-lived infrastructure. The practitioner conclusion is clear: campaign-stage visibility has to sit alongside detection and response.

Identity deception is the real control problem when attackers mimic authentication flows. The lure in this case was not just a malicious URL, but a passkey-shaped trust event designed to lower suspicion. That makes the incident relevant to IAM and identity verification governance because users are asked to validate trust at the exact point an attacker is trying to counterfeit it. Practitioners should treat login-flow impersonation as an identity abuse pattern, not only a phishing variant.

Campaign-level blocking beats domain-by-domain reaction. A single blocked domain does not solve a multi-domain, rapidly staged operation. The stronger pattern is to enumerate the cluster, understand related infrastructure, and push a broader enforcement decision into network and security controls. That approach aligns with MITRE-ATT&CK credential access and social engineering behaviour, and the practical conclusion is that one indicator should expand into a campaign containment decision.

The named concept here is pre-weaponisation coverage. This is the period after infrastructure is built and before it is used, when defenders still have a chance to act. The article shows that this window is where prevention lives, and once it closes the organisation is left with cleanup. For practitioners, the challenge is to operationalise that coverage before the attack path reaches a user.

From our research library:

• 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
• Read next: Threat Intelligence Guide

What this signals

Pre-weaponisation coverage: defenders need controls that act on staged infrastructure before the first user interaction, because waiting for compromise evidence leaves the campaign already in motion. The operational shift is from incident response to campaign interruption, which is far more effective against short-lived domains and rotating hosting.

Where the lure impersonates an authentication flow, identity assurance and network intelligence converge. A passkey-shaped phishing page is not just a web problem, it is an identity-trust problem that requires domain reputation, user reporting, and rapid enforcement to work together.

Silent Push cites that 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, which reinforces how attackers increasingly exploit collaboration and trust surfaces rather than only source code.

For practitioners

• Build a pre-weaponisation monitoring workflow Track newly observed domains, hosting clusters, and redirect infrastructure before they are associated with confirmed compromise so blocks can be applied ahead of execution.
• Map related infrastructure before blocking When one malicious domain appears, enumerate sibling domains and hosting assets so the response covers the campaign, not just the first URL.
• Treat authentication lures as identity events Escalate fake passkey or login-flow impersonation as an identity-risk incident, with user reports and help desk handling aligned to credential-harvest attempts.
• Push campaign indicators into firewall enforcement Convert confirmed adversary infrastructure into network blocks quickly, then maintain watch for newly staged domains that belong to the same operation.
• Rehearse second-attempt containment Test whether your team can stop a follow-on lure against another user after the first malicious domain is blocked, because adversaries often pivot fast.

Key takeaways

• The core failure mode is late visibility, because attackers can stage infrastructure before they launch the social engineering attempt.
• The article shows that early campaign intelligence can change response from one-domain blocking to whole-cluster containment.
• For identity and SOC teams, the practical lesson is to treat authentication impersonation and adversary infrastructure as a combined risk path.

Key terms

• Indicator Of Future Attack: An indicator of future attack is infrastructure, behaviour, or content that suggests an adversary is preparing a campaign before compromise is visible. It shifts detection from after the breach to before execution, which is critical for preemptive defense and AI-assisted triage.
• Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.
• Bullet-Proof Hosting: Bullet-proof hosting is hosting designed to resist takedowns, complaints, and law enforcement pressure. Operators use it to keep malicious sites, command infrastructure, or payment services online for longer periods. In cybercrime ecosystems, this kind of resilience supports ransomware, malware delivery, and other abuse that depends on persistent access.
• Passkey Impersonation: A phishing pattern in which an attacker copies the appearance and flow of a passkey-based sign-in experience. The goal is to exploit user trust in a modern authentication ceremony, making the lure more convincing than older password-only phishing pages.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect access control decisions to the wider governance model their programmes depend on.