Okta Warns of Real-Time Vishing Phishing Kits Targeting SSO and MFA

Okta reported that threat actors are using and selling custom voice-phishing (vishing) kits that enable helpdesk-style social engineering to steal credentials and bypass MFA for Okta SSO and other identity providers, including Google and Microsoft. The kits are offered “as a service” on dark web forums and messaging platforms and are designed to closely mimic legitimate identity-provider authentication flows, making the victim experience appear authentic during a live phone call.

Unlike static phishing pages, the kits function as adversary-in-the-middle platforms that let attackers monitor a victim’s session in real time and dynamically change what the victim sees (e.g., dialogs prompting for credentials or MFA approval) as the call progresses. Okta said operators typically conduct reconnaissance on targeted employees (names, applications used, and IT/helpdesk phone numbers), then call victims—often with spoofed corporate/helpdesk numbers—while guiding them through a tailored phishing page; captured credentials and MFA responses are relayed to the attacker to complete login and enable downstream data theft and extortion activity, echoing prior “IT support call” tradecraft associated with Scattered Spider-like intrusions.