Loading story…
Threat intelligence reporting describes mobile phishing kits evolving to coordinate web-based credential harvesting with live voice social engineering (vishing). The kits reportedly let operators update phishing pages in real time during a phone call—prompting victims to enter credentials and MFA/2FA codes on mobile browsers in sync with the caller’s instructions—raising the likelihood of successful account takeover, particularly where organizations rely on non-phishing-resistant MFA methods.
Separate mobile-security coverage highlights risks to 2FA code confidentiality on-device, including a disclosed issue in a mobile authenticator workflow where other apps could potentially access clipboard contents during code generation/entry, undermining 2FA protections if exploited on the same handset. Additional content in the set includes a general mobile app pentest write-up (not clearly tied to 2FA or the vishing-synced phishing kits) and a product showcase for the 2FAS Auth iOS authenticator, which is primarily promotional and not part of the same specific threat reporting.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Threat intelligence reporting described mobile-focused phishing kits that can update phishing pages in real time during a phone call, allowing attackers to align on-screen prompts with live social engineering. The technique increases the likelihood of stealing credentials and one-time MFA codes from victims using mobile browsers.
Following disclosure of the mobile authentication app weakness, guidance emphasized strengthening inter-app boundaries, tightening permission controls, and promptly installing mobile app updates to reduce clipboard leakage risk. The response framed mobile endpoint security as critical because compromised phones can undermine otherwise strong MFA protections.
A vulnerability in a widely used mobile authentication app was disclosed, showing that other apps on the same smartphone could potentially read clipboard contents while 2FA codes were being generated or entered. The issue raised the risk of unauthorized account access by weakening the integrity of the 2FA process on mobile devices.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple **MFA-bypass** techniques being operationalized against enterprise users, with a notable focus on Microsoft 365 and common authentication workflows. KnowBe4 Threat Labs described an active phishing campaign targeting North American organizations that abuses the **OAuth 2.0 Device Authorization Grant** (`microsoft.com/devicelogin`) to trick users into entering an attacker-supplied device code on a legitimate Microsoft page; after the user completes MFA, the attacker obtains valid **OAuth access/refresh tokens**, enabling persistent access to M365 services (e.g., Outlook, Teams, OneDrive/SharePoint) without stealing passwords. Recommended mitigations included auditing newly consented OAuth apps, hunting for related email lure patterns, and considering disabling the device code flow via Conditional Access. Separately, Okta warned of emerging **voice-phishing (vishing) kits** that provide real-time, client-side “session orchestration,” allowing attackers to dynamically change phishing pages while on a phone call to coax victims into approving push prompts or providing OTPs; captured credentials are commonly exfiltrated to attacker-controlled channels (e.g., Telegram) and then replayed against legitimate sign-in flows. Cyble also documented the continued evolution of **SMS/OTP (and voice) bombing** ecosystems, highlighting automated, API-driven abuse of authentication endpoints across multiple sectors and regions, with tooling maturing into cross-platform applications and adding evasion features—activity that can facilitate social engineering and account takeover by overwhelming users with authentication messages or calls.
Jun 29, 2026
Okta reported that threat actors are using and selling custom **voice-phishing (vishing) kits** that enable helpdesk-style social engineering to steal credentials and bypass MFA for **Okta SSO** and other identity providers, including **Google** and **Microsoft**. The kits are offered “as a service” on dark web forums and messaging platforms and are designed to closely mimic legitimate identity-provider authentication flows, making the victim experience appear authentic during a live phone call. Unlike static phishing pages, the kits function as **adversary-in-the-middle** platforms that let attackers monitor a victim’s session in real time and dynamically change what the victim sees (e.g., dialogs prompting for credentials or MFA approval) as the call progresses. Okta said operators typically conduct reconnaissance on targeted employees (names, applications used, and IT/helpdesk phone numbers), then call victims—often with spoofed corporate/helpdesk numbers—while guiding them through a tailored phishing page; captured credentials and MFA responses are relayed to the attacker to complete login and enable downstream **data theft and extortion** activity, echoing prior “IT support call” tradecraft associated with **Scattered Spider-like** intrusions.
Jun 29, 2026
Voice phishing is emerging as a major initial-access tactic as attackers impersonate employees, help-desk staff, and senior officials to steal credentials, capture one-time passcodes, and transfer MFA enrollment. U.S. government warnings and industry reporting describe malicious messaging and vishing campaigns that use phone calls, SMS, and collaboration platforms such as Microsoft Teams to manipulate targets into granting access to single sign-on and cloud environments. Group-IB and CIS both report that advances in synthetic speech, real-time voice transformation, and voice cloning are lowering the cost and skill barrier for these scams, while incident data cited by defenders shows vishing accounting for a growing share of intrusions. The technique has been linked to serious downstream compromises, including an alleged **ShinyHunters** breach at Harvard University in which attackers reportedly used voice phishing to bypass MFA and access **Microsoft 365**, **SharePoint**, and **Salesforce**, exposing roughly **115,000** records tied to alumni and development operations. Security guidance across the referenced reporting urges organizations to harden identity workflows rather than rely on user recognition of suspicious calls, with emphasis on phishing-resistant MFA such as **FIDO2**, stricter help-desk identity verification, protection of passkey enrollment, and monitoring for anomalous authentication and account-recovery activity.
Aug 21, 2026