The Rise of One-Time Password Interception Bots
Summary: After KrebsOnSecurity reported in February on Otp[.]agency, a service that placed automated calls to trick targets into reading back one-time passwords, that service went offline within hours and new competitors emerged on Telegram. Intel 471 found that a bot called SMSRanger runs on slash commands targeting specific banks, PayPal, Apple Pay, Google Pay, or a wireless carrier, and users claim an efficacy rate of about 80% when the victim answered the call and the supplied personal information was accurate.
What you should know: These services assume the attacker already holds the target's credentials, so the second factor is the only thing left standing between a stolen password and account access - and an 80% claimed success rate against a victim who picks up the phone is a thin margin.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026