0ktapus SMS Phishing Campaign Stole Okta Credentials and 2FA Codes

Group-IB reported that a large-scale phishing operation dubbed 0ktapus targeted organizations using Okta by sending employees SMS messages that linked to fake Okta sign-in pages. The campaign harvested usernames, passwords, and one-time 2FA codes, allowing attackers to use stolen credentials almost immediately before the codes expired. Researchers said the operation relied on relatively simple infrastructure, including 169 phishing domains, a Nuxt.js frontend, a Django backend, and Telegram bots and channels used to collect stolen data in near real time.

The activity was linked to compromises across multiple sectors, including IT, cloud services, finance, telecommunications, and cryptocurrency, with victims concentrated in the United States and Canada. Group-IB said the campaign was active by at least March 2022 and expanded into supply-chain intrusions affecting Twilio, Mailchimp, and Klaviyo, with downstream impact on customers of Signal and DigitalOcean. The firm said the attackers likely sought access to private data, internal documents, financial assets, and user accounts, and it urged organizations to adopt phishing-resistant MFA such as FIDO2 security keys, verify login URLs carefully, and reset credentials and revoke sessions immediately after suspected compromise.