new campaign — GraphSpy model
last generated session
—
rotation is automatic — on expiry a fresh code is minted and the lure page shows it without the victim noticing.
device login URLs (GraphSpy set)
whichever of these you put in the lure text — the victim types the code there.