Loading story…
Okta Threat Intelligence reported that Work Panel is a multi-tenant cybercrime-as-a-service platform used to run organized vishing campaigns targeting identity and SaaS brands including Okta, Microsoft 365, and Salesforce. The platform supports the full attack chain: domain registration, brand-cloned phishing pages, target discovery through RocketReach, phishing email delivery, SIP-based call routing, and real-time credential capture with Telegram alerts. Okta linked the platform to at least one tracked intrusion cluster, O-UNC-045 / CORDIAL SPIDER, and said its behavior aligns with MITRE ATT&CK techniques covering phishing, account abuse, adversary-in-the-middle activity, and infrastructure acquisition.
Researchers described Work Panel as a mature, SaaS-like criminal operations system with role-based access for callers, managers, and administrators, plus audit logging, secret rotation, and infrastructure automation. The service also separates infrastructure operators from hired callers, reflecting a broader labor-specialized vishing ecosystem in which recruitment occurs openly on underground channels. Okta said the platform includes operational security features such as server-side segregation of stolen credentials and a self-destruct function that can remove phishing sites, processes, and DNS records, allowing campaigns to be launched, rebranded, and dismantled quickly.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
On July 28, 2026, Okta Threat Intelligence published an analysis describing Work Panel as a multi-tenant cybercrime-as-a-service platform used for organized vishing campaigns. The report linked the platform to at least one intrusion cluster tracked as O-UNC-045, also known as CORDIAL SPIDER, and detailed capabilities including phishing site cloning, target discovery, call routing, credential capture, and operational security features.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
meetcyber.net
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecyberveille.ch
Open sourceokta.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Okta reported that threat actors are using and selling custom **voice-phishing (vishing) kits** that enable helpdesk-style social engineering to steal credentials and bypass MFA for **Okta SSO** and other identity providers, including **Google** and **Microsoft**. The kits are offered “as a service” on dark web forums and messaging platforms and are designed to closely mimic legitimate identity-provider authentication flows, making the victim experience appear authentic during a live phone call. Unlike static phishing pages, the kits function as **adversary-in-the-middle** platforms that let attackers monitor a victim’s session in real time and dynamically change what the victim sees (e.g., dialogs prompting for credentials or MFA approval) as the call progresses. Okta said operators typically conduct reconnaissance on targeted employees (names, applications used, and IT/helpdesk phone numbers), then call victims—often with spoofed corporate/helpdesk numbers—while guiding them through a tailored phishing page; captured credentials and MFA responses are relayed to the attacker to complete login and enable downstream **data theft and extortion** activity, echoing prior “IT support call” tradecraft associated with **Scattered Spider-like** intrusions.
Jun 29, 2026
A series of social-engineering campaigns targeted organizations that relied on **Okta** and similar identity systems, using SMS phishing, fake login portals, and later voice calls impersonating IT staff to steal credentials, MFA codes, and session tokens. Group-IB said the **0ktapus** operation targeted **136 organizations**, used **169** lookalike domains, and compromised thousands of accounts, with victims concentrated in technology, software, and cloud sectors in the United States and Canada. Reporting tied the same activity to breaches at **Twilio**, **Cloudflare**, **DoorDash**, and later **Coinbase**, where an attacker obtained an employee username and password and accessed limited corporate directory data but was blocked from broader access by MFA controls and incident response. Subsequent reporting described an evolution from SMS phishing to **vishing** and adversary-in-the-middle phishing kits that mirrored corporate SSO flows in real time, enabling theft of session tokens even after MFA was completed. Mandiant and other researchers linked a 2026 wave under the **ShinyHunters** banner to more than **400 organizations**, with attackers using branded phishing sites, harvesting cloud data from **SharePoint**, **OneDrive**, **Salesforce**, and **Slack**, and following theft with extortion demands. Across the incidents, phishing-resistant **FIDO2** security keys stood out as an effective defense, while earlier disputes over Okta-related intrusions, including claims by **Lapsus$**, underscored how compromises of identity providers and support channels can cascade into downstream customer exposure.
Jun 29, 2026
Attackers are increasingly abusing trusted enterprise collaboration platforms including **Microsoft Teams, Slack, and Google Meet** to steal credentials, impersonate employees, deliver malware, and maintain post-compromise access. Palo Alto Networks Unit 42 reported that alerts tied to malicious activity on collaboration tools increased more than fourfold over the past year, with **99%** of those alerts linked to chat-based phishing. The activity reflects a shift from obviously malicious infrastructure to legitimate communication channels that users and defenders often trust by default. Documented cases include **APT29** phishing through Microsoft Teams, adversary-in-the-middle credential theft using attacker-controlled Slack workspaces, the **Contagious Interview** campaign themed around Fireblocks, the compromise of an **Axios npm** maintainer, Slack phishing reported by **OpenSSF** against Linux Foundation communities, and **CERT Polska** findings on Slack webhook abuse for persistence and credential exfiltration. Researchers said collaboration platforms now form part of the enterprise identity attack surface and urged organizations to tighten guest and federation controls, enforce stronger identity protections, verify sensitive requests through secondary channels, and correlate collaboration, endpoint, and network telemetry in monitoring and incident response.
Aug 31, 2026