Hey folks,
Been tracking the Blackfile passkey/mfa campaign for weeks or months now. Saw a recent listing from Unit42 that was missing a few domains I have, and had a few domains I missed.
blackfile_0909 is the 32 domains I’ve got with high confidence they’re part of the ongoing Blackfile campaign.
blackfile_adjacent is dozens more domains seen on the same/similar infra that look shady enough to block ASAP.
blackfile_adjacent_0909.csv (155.5 KB)
blackfile_0909.csv (59.5 KB)
Moved to Threat Intel
Microsoft has joined the chat.
| Indicators | Type | Description |
|---|---|---|
| passkeyhelpdesk[.]com | Domains | Passkey support lure |
| secure-passkey[.]com | Domains | Passkey security |
| setupmypasskey[.]com | Domains | Passkey setup |
| add-passkey[.]com | Domains | Passkey enrollment |
| integratedsso[.]com | Domains | SSO |
| oktasession[.]com | Domains | Identity-provider session |
| keysyncos[.]com | Domains | Key synchronization |
| oskeysync[.]com | Domains | Key synchronization |
| oskeysetup[.]com | Domains | Key setup |
| oskeyregister[.]com | Domains | Key registration |
| syncmykey[.]com | Domains | Key synchronization |
| myconnectkey[.]com | Domains | Key connection |
| oskeyconnect[.]com | Domains | Key connection |
| validationsetupac[.]com | Domains | Account validation and setup |
| portalsetuphub[.]com | Domains | Portal setup |
NOTE: This list has not been verified good or bad, unless it overlaps with another intel agencies listing. I’m simply interested in domain variations with auth and notification themes including google and microsoft where the NS is Cloudflare and weirder.
The results make me hmm..
I don’t work for an intel agency with a stock pile of data, nor am I providing a service to customer-base, but as a front-line defender wearing a stack of hats, I can perform a cursory threat hunt on historical data for good measure, for both potential threat and operational impact.
Then deploy what I’d categorize as a mitigation of low-regret and block them all. Maybe it’s just a squatter, I personally don’t care to find out; instead, I’m going to use the data from Unit42, Microsoft, Domain Tools, and Infoblox to seed domain generation scripts and scorch them all.
| Domain | Nameservers |
|---|---|
google-sso.com |
joan.ns.cloudflare.com., kurt.ns.cloudflare.com. |
sso-google.com |
conrad.ns.cloudflare.com., hattie.ns.cloudflare.com. |
login-google.com |
anna.ns.cloudflare.com., josh.ns.cloudflare.com. |
securegoogle.com |
ben.ns.cloudflare.com., leah.ns.cloudflare.com. |
googleverify.com |
peaches.ns.cloudflare.com., toby.ns.cloudflare.com. |
portal-google.com |
hunts.ns.cloudflare.com., kira.ns.cloudflare.com. |
verifygoogle.com |
ainsley.ns.cloudflare.com., jason.ns.cloudflare.com. |
account-google.com |
fay.ns.cloudflare.com., osmar.ns.cloudflare.com. |
password-google.com |
opal.ns.cloudflare.com., pedro.ns.cloudflare.com. |
googlelogon.com |
dara.ns.cloudflare.com., gordon.ns.cloudflare.com. |
google-admin.com |
bayan.ns.cloudflare.com., lana.ns.cloudflare.com. |
admin-google.com |
opal.ns.cloudflare.com., pedro.ns.cloudflare.com. |
authn-google.com |
jimmy.ns.cloudflare.com., martha.ns.cloudflare.com. |
googleconfirm.com |
ariadne.ns.cloudflare.com., lennon.ns.cloudflare.com. |
google-security-alert.com |
eric.ns.cloudflare.com., naya.ns.cloudflare.com. |
google-notify.com |
coleman.ns.cloudflare.com., iris.ns.cloudflare.com. |
googlenotification.com |
anahi.ns.cloudflare.com., jacob.ns.cloudflare.com. |
microsoftsso.com |
chris.ns.cloudflare.com., grace.ns.cloudflare.com. |
microsoft-sso.com |
ada.ns.cloudflare.com., mike.ns.cloudflare.com. |
ssomicrosoft.com |
albert.ns.cloudflare.com., piper.ns.cloudflare.com. |
sso-microsoft.com |
georgia.ns.cloudflare.com., salvador.ns.cloudflare.com. |
microsoftportal.com |
devin.ns.cloudflare.com., lana.ns.cloudflare.com. |
verify-microsoft.com |
clint.ns.cloudflare.com., lana.ns.cloudflare.com. |
myaccount-microsoft.com |
martin.ns.cloudflare.com., noor.ns.cloudflare.com. |
microsoft-okta.com |
tess.ns.cloudflare.com., vasilii.ns.cloudflare.com. |
logonmicrosoft.com |
conrad.ns.cloudflare.com., stephane.ns.cloudflare.com. |
signon-microsoft.com |
itzel.ns.cloudflare.com., stan.ns.cloudflare.com. |
adminmicrosoft.com |
gwen.ns.cloudflare.com., seth.ns.cloudflare.com. |
microsoftrecovery.com |
coraline.ns.cloudflare.com., george.ns.cloudflare.com. |
microsoft-recovery.com |
bonnie.ns.cloudflare.com., dylan.ns.cloudflare.com. |
microsoft-access.com |
novalee.ns.cloudflare.com., wilson.ns.cloudflare.com. |
microsoftsecurityalert.com |
dexter.ns.cloudflare.com., luciane.ns.cloudflare.com. |
microsoft-securityalert.com |
natasha.ns.cloudflare.com., ryan.ns.cloudflare.com. |
microsoftconfirm.com |
jasper.ns.cloudflare.com., lana.ns.cloudflare.com. |
microsoftalerts.com |
rene.ns.cloudflare.com., roxy.ns.cloudflare.com. |
googlelivechat.com |
harley.ns.cloudflare.com., lila.ns.cloudflare.com. |
microsoft-remote.com |
dolly.ns.cloudflare.com., seamus.ns.cloudflare.com. |
Similar with other weird nameservers unlikely to be owned by Google or Microsoft.
| Domain | Nameserver |
|---|---|
duo-mfa.com |
ns4.wixdns.net., ns5.wixdns.net. |
google-portal.com |
curitiba.ns.porkbun.com., fortaleza.ns.porkbun.com., maceio.ns.porkbun.com., salvador.ns.porkbun.com. |
google-notification.com |
ns1.netim.net., ns2.netim.net., ns3.netim.net. |
auth-microsoft.com |
ns.forpsi.cz., ns.forpsi.it., ns.forpsi.net. |
microsoft-notification.com |
ns3.netim.net., ns2.netim.net., ns1.netim.net. |
Happy hump day hunting!
A not-at-all important note on attribution: Microsoft claims in their writeup that:
Storm-3032 represents a set of actors that splintered from the BlackFile group and now operate under the Helix extortion banner.
So if someone says “Helix” for the TA name, same diff.
These indicators have been added to the MISP feed. Only the high confidence ones are marked to be added to IDS blocks.
Adding my medium-high confidence list of Blackfile domains suspected to be directly connected to this campaign. Unit42’s were solid, I’m not entirely sure about a couple of Microsoft’s.
55 domains in all.
blackfile_medhighconfidence_0910.csv (101.8 KB)
New indicators once again MISPed
Blackfile-suspected list (attached) up to 59. Medium-high confidence.
Also attached CSV of 134 domains connected or adjacent to Blackfile/ShinyHunters from Sept 11-14, all worth blocking preemptively.
The following is provided for intelligence purposes only, inclusion does not necessarily indicate criminality.
New activity:
passkeyoptions[.]com (Fleetcor, Bainco, Global-E, Dechert, Lendio, BigCommerce, Ring)
register-passkeys[.]com (Ciena)
installpasskey[.]com (Billcom)
Newly seen:
Blackfile/Helix campaign high confidence:
add-mfa[.]com
hashkey-exchange[.]com
passkey-auth[.]com
Medium confidence:
globalkeysec[.]com
Blackfile-adjacent-2026-09-11-14.csv (241.7 KB)
Blackfile-suspected-2026-09-14.csv (108.8 KB)
ssokeyportal[.]com - showed up 20 mins ago
Morning trawl for ShinyHunters/Blackfile and adjacent:
globalkeysecwork[.]com
challenge-onekey[.]com
agentkeystore[.]com
myaccount-auth[.]com
m365-authservices[.]com
also seeing what looks like an evolution in more direct targeting in apex domains, using “report-”:
report-westernunion[.]com
report-marriott[.]com
report-crypto[.]com
report-target[.]com
report-roblox[.]com
report-hyatt[.]com
report-unum[.]com
likely unrelated but very suspicious:
secure-clientverificationportal[.]com
trustlinksecure[.]com
73015-accessauth[.]com
pcsecurehub[.]com
Blackfile_and_adjacent_2026_09_15.csv (38.9 KB)
📎 TLP:CLEAR
Up early so figured I’d flag a few more Blackfile/Helix and adjacent domains. Flying out this afternoon to LABScon and then a work onsite in Chicago so may be scarce for the next week or so, but will try to continue updates where I can.
Note we now see domains ending in “-report” as well as beginning in “report-”.
High confidence:
key-setup[.]com
report-oreillyauto[.]com
westernunion-report[.]com
Medium confidence:
oauthcheck[.]com
accounts-auth[.]com
adjacent:
verification-form[.]com
Blackfile_adjacent_09_16.csv (15.4 KB)
Full list of medium-high confidence Blackfile/Helix domains from 08/20 onward is up to 74
Blackfile_suspected_09_16.csv (139.0 KB)
adding: reset-support[.]com
Further Blackfile domain observed, courtesy of @neurovagrant.
hcm-cor[.]com
The MISP event has been duly updated.
© 2026 by The Independent Federated Intelligence Network Inc. Licensed under CC BY-NC-ND 4.0
