Voice and SMS phishing campaigns abused Okta workflows to breach hundreds of firms

A series of social-engineering campaigns targeted organizations that relied on Okta and similar identity systems, using SMS phishing, fake login portals, and later voice calls impersonating IT staff to steal credentials, MFA codes, and session tokens. Group-IB said the 0ktapus operation targeted 136 organizations, used 169 lookalike domains, and compromised thousands of accounts, with victims concentrated in technology, software, and cloud sectors in the United States and Canada. Reporting tied the same activity to breaches at Twilio, Cloudflare, DoorDash, and later Coinbase, where an attacker obtained an employee username and password and accessed limited corporate directory data but was blocked from broader access by MFA controls and incident response.

Subsequent reporting described an evolution from SMS phishing to vishing and adversary-in-the-middle phishing kits that mirrored corporate SSO flows in real time, enabling theft of session tokens even after MFA was completed. Mandiant and other researchers linked a 2026 wave under the ShinyHunters banner to more than 400 organizations, with attackers using branded phishing sites, harvesting cloud data from SharePoint, OneDrive, Salesforce, and Slack, and following theft with extortion demands. Across the incidents, phishing-resistant FIDO2 security keys stood out as an effective defense, while earlier disputes over Okta-related intrusions, including claims by Lapsus$, underscored how compromises of identity providers and support channels can cascade into downstream customer exposure.