A massive phishing campaign tied to abuse of identity provider Okta compromised 9,931 accounts across more than 130 organizations, according to researchers at Group-IB.
The attackers, dubbed “0ktapus” for their focus on Okta authentication systems, started by targeting telecommunications companies to harvest phone numbers. They then sent SMS messages containing links to fake Okta login pages that mimicked each target’s corporate authentication portal.
The goal wasn’t just credentials — they wanted MFA codes too. With both in hand, the attackers could bypass multi-factor authentication entirely. The ultimate target was company mailing lists and customer-facing systems, setting the stage for supply-chain attacks.
DoorDash disclosed a related incident within hours of Group-IB’s report. An unauthorized party used stolen vendor employee credentials to access internal tools and steal personal information including names, phone numbers, email addresses, and delivery addresses of customers and drivers.
The campaign compromised 5,441 MFA codes in total. Security experts noted that FIDO2-compliant security keys would have stopped this attack cold, since they’re resistant to phishing by design. The researchers recommended URL awareness training and phishing-resistant MFA as immediate mitigations.
114 of the affected firms were US-based, with victims spread across 68 additional countries. The full scope may not be known for some time.
