MCP-driven phishing hunting shifts infrastructure correlation to agents

At a glance

What this is: This is Silent Push’s account of using its MCP server with Claude to hunt a World Cup phishing cluster and rapidly generate repeatable infrastructure queries.

Why it matters: It matters because IAM, SOC, and threat-hunting teams increasingly need governance for AI-assisted investigation workflows that touch DNS, watchlists, blocklists, and external data pivots.

By the numbers:

• On the first day of the World Cup, 227 new domains matching that pattern had already been registered.

Context

MCP, or Model Context Protocol, is a way to connect an AI system to tools and data sources so it can retrieve context and act on structured information rather than on static prompts alone. In this case, the article applies that model to threat hunting, where the practical issue is not just finding data but turning it into repeatable investigative workflows. MCP security guide

The governance gap is familiar to security teams: manual pivots do not scale when fraud infrastructure appears quickly and in clusters. Once an analyst can generate queries from one investigation and feed them into recurring detection jobs, the control problem shifts toward how those generated queries are trusted, reviewed, and operationalised across SOC tooling.

Key questions

Q: How should security teams handle autonomous AI tools that generate threat-detection queries at scale?

A: Security teams should treat autonomous query generation as a force multiplier, not a control by itself. The priority is to constrain where those queries run, validate their outputs against trusted data sources, and preserve analyst oversight for high-impact decisions. Without governance, speed can amplify false positives, blind spots, and inconsistent response. The safe pattern is controlled automation, clear ownership, and continuous review of detection quality.

Q: Why do event-driven phishing campaigns require infrastructure-based detection?

A: Because single domains are disposable, while infrastructure patterns are reusable. Fraud operators can spin up new sites quickly, but they tend to repeat favicons, naming conventions, certificates, and hosting choices. Detection that keys on those shared traits can find the broader cluster instead of chasing one site at a time.

Q: What are the risks of connecting MCP servers to security tooling?

A: The main risks are overbroad data access, unreviewed query generation, and silent reuse of machine-produced outputs in operational workflows. If an MCP-connected workflow can pull from threat data and feed hunts or response actions, teams need governance around permissions, logging, approval, and rollback.

Q: What should SOC teams do when detection is strong but investigations still lag?

A: They should add an investigation layer that can reason across telemetry, identity, and response context, then route only the cases that genuinely need human judgement. The goal is to reduce manual triage bottlenecks, not to replace detection or over-automate containment without evidence.

Technical breakdown

How MCP connects investigation prompts to threat data

The MCP server acts as a connector between the analyst’s AI workflow and Silent Push datasets. Instead of asking the model to reason from memory, the user describes the investigation and the server retrieves DNS records, WHOIS data, SSL certificates, host scans, and web fingerprints to produce structured results. The value is not the model alone, but the chain from prompt to enrichment to query generation. That means the output can be reused in a Context Graph search, a SOAR workflow, or a SIEM hunt without retyping the logic. See the MCP Security Guide.

Practical implication: treat AI-generated hunt logic as an artefact that needs review before it is pushed into recurring detection workflows.

Why infrastructure fingerprints are more useful than single-domain blocking

Fraud operators often reuse recognizable infrastructure traits because speed matters more than uniqueness. Shared favicons, naming conventions, and hosting patterns create a fingerprint that can be correlated across multiple domains even when the domains themselves change. This is especially important in event-driven fraud, where lookalike sites are spun up quickly and replaced often. Correlation beats single IOC blocking because the attacker’s pattern is more stable than any one site. That is why infrastructure analysis is a stronger hunting primitive than chasing each new registration individually. See the Threat Hunting Guide.

Practical implication: build hunts around reusable infrastructure patterns rather than relying only on one-off domain indicators.

How generated queries feed SOC automation safely

The article describes a flow from generated query to daily execution in XSOAR, then into Splunk, watchlists, or blocklists. Architecturally, that turns a one-time investigation into a standing detection pattern. The governance question is not whether automation is useful, but whether the query logic has been validated, deduplicated, and tied to explicit thresholds before it is operationalised. Once hunting output drives automated response, false positives can become workflow noise and bad pivots can be amplified at machine speed.

Practical implication: put human review and change control in front of any hunt query that will feed SOAR or blocklist actions.

Threat narrative

Attacker objective: The objective is to scale a fraudulent event-commerce ecosystem that can deceive victims and persist through rapid domain replacement.

1. Entry occurred through fraudulent World Cup ticket and merchandise sites built from a reusable domain pattern and promoted through infrastructure designed to scale quickly.
2. Escalation came from the attackers’ ability to register 227 matching domains on the first day of the tournament, expanding the footprint faster than manual review could keep pace.
3. Impact is the ability to sustain a large fraud ecosystem that can rotate lookalike sites, evade isolated takedowns, and keep users moving toward fake purchases.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP changes threat hunting from manual pivoting to governed query generation. The operational shift here is not about replacing analysts, but about making the analyst’s investigation logic portable across tools and repeatable over time. That creates a new governance surface around who can generate, approve, and operationalise machine-assisted hunt logic. Teams should treat MCP security guide workflows as part of the detection stack, not as an ungoverned convenience layer.

Fraud infrastructure is now a correlation problem, not just a takedown problem. Event-driven phishing campaigns survive by cloning patterns quickly, which means single-domain blocking is always behind the attack tempo. The named concept here is infrastructure fingerprint persistence: the reused favicons, naming conventions, and hosting traits that outlast any one domain. Practitioners should build detections around the pattern, not the individual site.

Security teams need a control model for AI-generated investigations. When a model produces queries that are then pushed into XSOAR, Splunk, or blocklists, the output becomes part of operational security decision-making. That raises questions of provenance, review, and rollback if the generated logic is wrong or overly broad. The practitioner conclusion is simple: validate agent-generated hunt logic before it becomes an operational control.

Agentic tooling will matter most where the data source is already structured and adversarial patterns are repetitive. DNS, WHOIS, certificates, and host fingerprints are exactly the kind of data that agent-assisted workflows can correlate efficiently. But the more autonomous the workflow becomes, the more important it is to define the boundary between assistance and action. Teams should reserve machine execution for validated detections, not exploratory hunting alone.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: Threat Hunting Guide

What this signals

Query provenance will become a governance issue for hunting teams. Once investigation logic is generated by an AI workflow and reused in daily detection jobs, the question changes from discovery to control. Teams need to know who approved the logic, what data it touched, and how they would unwind it if the pattern changes.

Infrastructure fingerprinting is the durable defence here. Fraud domains can be replaced quickly, but repeated DNS, registration, and branding traits remain huntable across a campaign. That makes the strongest programme move a shift from reactive takedown to pattern-based correlation across external intelligence sources.

MCP-connected security workflows should be treated as an extension of the detection engineering stack. The more they feed SIEM, SOAR, or blocklists, the more they require change management, validation, and logging. Agentic assistance is useful, but only when the workflow has clear boundaries between analysis and action.

For practitioners

• Define approval boundaries for AI-generated hunt queries Require human review before any generated query is promoted into daily SOAR execution, watchlists, or blocklists.
• Hunt on infrastructure fingerprints, not single domains Track shared favicons, naming conventions, registration patterns, and hosting clusters so you can identify new lookalike sites as they appear.
• Validate MCP-connected data flows before production use Review which datasets the MCP server can reach, what prompts it can translate into queries, and where output is stored or reused.
• Tune SOC workflows for deduplication and rollback Make sure repeated hits are deduplicated before escalation and that any automated block or watch action can be reversed quickly if the pattern shifts.

Key takeaways

• The article shows how MCP can accelerate threat hunting by turning one investigation into reusable infrastructure queries.
• The fraud example matters because 227 matching domains appeared on the first day, showing how quickly event-based abuse can scale.
• The key control is governance around generated hunt logic, especially before that logic is fed into SOAR, SIEM, or blocklists.

Related NHI Mgmt Group resources: MCP Security Guide · Threat Hunting Guide · Phishing Guide · Atlassian Cloud Security Guide

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Infrastructure Fingerprinting: The process of identifying repeated technical patterns in domains, hosting, channels, or accounts that reveal a shared operation. It allows analysts to connect separate artefacts into one network view and to recognise new assets as part of the same campaign.
• Threat automation: Threat automation is the use of scripts, tooling, and AI-assisted workflows to increase the speed, volume, and variation of attacker activity. In identity security, it matters because it compresses the time available to detect abuse, contain access, and recover before data or privileges are lost.
• Fraud Infrastructure: Fraud infrastructure is the technical stack that makes a scam appear legitimate enough to steal money, including websites, domains, hosting, payment rails, and operational tooling. In crypto-enabled fraud, this layer matters because it allows operators to scale quickly, rotate assets, and keep victim-facing services online despite enforcement or takedown actions.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security workflows their programmes depend on.