The 0ktapus threat group executed a sprawling phishing campaign that spoofed Okta's multi-factor authentication system to steal identity credentials and MFA codes from employees of over 130 organizations. The campaign began by targeting telecommunications companies to collect phone numbers, then sent phishing SMS messages containing links to fake Okta login pages. Victims submitted their credentials and MFA codes, enabling attackers to compromise 9,931 accounts. The attackers aimed to access company mailing lists and customer-facing systems to facilitate supply-chain attacks. The campaign affected primarily US-based firms but also victims in 68 other countries. The campaign highlights the ability of phishing attacks to circumvent MFA protections, emphasizing the need for stronger authentication methods such as FIDO2 security keys and user education on MFA attack vectors.

The campaign compromised nearly 10,000 accounts across over 130 organizations, including 114 US-based companies and victims in 68 additional countries. Attackers obtained Okta credentials and MFA codes, enabling unauthorized access to internal tools and systems. In a related incident, DoorDash reported unauthorized access to internal tools and theft of personal information of customers and delivery personnel. The campaign demonstrates that MFA, while a strong security control, can be bypassed through sophisticated phishing attacks, leading to significant data breaches and potential supply-chain compromises.

No official patch or fix applies as this is a phishing campaign rather than a software vulnerability. Researchers recommend using FIDO2-compliant security keys for MFA to provide phishing-resistant authentication. Additionally, organizations should educate users about common MFA attack techniques and how to recognize and respond to phishing attempts. Good hygiene around URLs and passwords is also advised. There is no indication that the threat has been fully mitigated or that no action is required.