How 1-Time Passcodes Became a Corporate Liability
Summary: A cybercriminal group dubbed "0ktapus" used SMS phishing pages mimicking employers' Okta login screens to harvest usernames, passwords and one-time passcodes, generating nearly 10,000 replies from employees at more than a hundred companies over roughly two months in mid-2022. The stolen credentials were forwarded in real time through a Telegram bot, and the group hit Cloudflare, Twilio, T-Mobile, Mailchimp, Klaviyo and customer support firms including Sitel and Teleperformance, with Twilio's breach exposing data on roughly 1,900 Signal users.
Bottom line: Okta reported this year that 47 percent of workforce customers still deploy SMS and voice factors for multi-factor authentication, so the one-time codes this group harvested in real time remain the second factor at nearly half the market.
Read the original at Krebs on Security ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026