In 2022, 0ktapus texted staff fake IT alerts linking to Okta lookalikes, stealing 9,931 logins and MFA codes. Twilio was breached; Cloudflare's keys held.
Social Engineering Examples·7 sources
From March to August 2022, a group researchers call 0ktapus sent text messages to employees of companies that use Okta for logins. The texts posed as the company's IT team, warning of an expired password or a schedule change, and linked to a perfect copy of the company's Okta login page. Group-IB found the attackers had collected 9,931 credentials and 5,441 MFA codes across 136 corporate email domains. Twilio, Mailchimp and Klaviyo were breached. Cloudflare was targeted but stopped it. Status: Documented campaign.
| Step | What happened |
|---|---|
| Domains | The attackers registered lookalike addresses mixing the target's name with words like "okta", "sso", "vpn" or "help". Group-IB found 169 |
| Text | Employees got an SMS "from IT": password expired, or schedule changed, with a link |
| Fake login | The link opened an exact copy of the company's Okta page |
| Live relay | Usernames and passwords went straight to the attackers via Telegram, who used them on the real site |
| MFA code | The fake page then asked for the one-time code, which was relayed and used before it expired |
SMS was chosen on purpose. Texts feel personal and urgent, and they skip email filters. In some cases the page also pushed the AnyDesk remote-access tool. Cloudflare said its lookalike domain was registered less than 40 minutes before the texts went out. This is smishing combined with credential harvesting.
Tip: IT doesn't text you urgent login links. If one arrives, go to your company's login page the usual way instead.
| Company | What happened |
|---|---|
| Twilio | Breached; detected 4 August 2022. Its final count was 209 affected customers and 93 Authy accounts |
| Signal (via Twilio) | About 1,900 phone numbers exposed to possible re-registration |
| Mailchimp | Breached; this touched DigitalOcean's transactional email |
| Klaviyo | Breached |
| Cloudflare | Targeted on 20 July 2022; not breached |
Group-IB found the operation while investigating a client incident and published it on 25 August 2022. Of the 9,931 credentials, about 3,120 used corporate email addresses. Most targets were US technology, software and cloud firms. No dollar figure for the whole campaign has been published. Later reporting linked the tactics to the wider Scattered Spider ecosystem; Okta tracked related activity as "Scatter Swine".
76 Cloudflare employees received the texts and three entered their credentials. That should have been enough. It wasn't, because Cloudflare used FIDO2 hardware security keys. Those keys check which website is asking before they respond, so they won't work on a fake site. The same attack that broke into companies relying on one-time codes failed against the keys.
See also the 2020 Twitter hack, which used the same live-relay trick by phone, and account takeover.
A 2022 smishing campaign that sent fake IT texts to employees and harvested Okta logins and MFA codes from more than 130 organisations.
The fake login page asked for the one-time code too, and the attackers used it on the real site within seconds, before it expired.
Twilio, Mailchimp and Klaviyo were breached. Signal and DigitalOcean were affected through those suppliers. Cloudflare was targeted but not breached.
No. The attackers faked Okta login pages to steal the credentials of Okta's customers' employees.
Social Engineering Examples. “0ktapus: the 2022 Okta smishing campaign behind the Twilio breach”. Accessed 3 November 2026. https://socialengineeringexamples.com/0ktapus-okta-phishing-campaign-2022
The operation is documented (per Twilio's own incident report and the CISA/FBI advisory AA23-320A on the related Scattered Spider ecosystem) as compiling employee names and personal mobile phone numbers, in some cases including family members, likely drawn from data brokers, prior breach dumps, or OSINT such as LinkedIn and corporate directories, to make bulk SMS lures land convincingly.
Employee and family personal phone numbers scattered across data brokers and breach dumps are largely outside a company's direct control; the realistic control sits downstream, training staff to distrust unsolicited "IT" texts no matter how the attacker got the number, and watching for bulk lookalike-domain registrations against the brand.
Attackers registered lookalike domains pairing the target company's brand with identity-provider keywords such as "okta," "sso," "vpn," "mfa," and "help" through low-friction registrars, and built a phishing kit that cloned the victim's exact Okta/SSO login page, hosted on commodity cloud infrastructure; Group-IB catalogued 169 such domains.
Monitor domain registrars and certificate-transparency logs for newly registered lookalike domains combining the company brand with SSO-related keywords, and use secure web gateway or DNS filtering that flags or blocks very recently registered domains by default.
Attackers sent bulk smishing texts spoofed as internal IT or help desk, using urgency themes like password expiration or a schedule change, and rotated across phone numbers and carriers to stay ahead of blocking.
Give employees a fast, low-friction way to report suspicious texts to a security team, and train staff that legitimate IT will not send urgent, unsolicited login links by SMS.
Employees who clicked through landed on the pixel-accurate fake Okta page and entered their username and password, believing it was their real employer SSO portal.
Verify the exact SSO/Okta domain before entering credentials, and rely on enterprise browser or password-manager controls that refuse to auto-fill credentials on a domain that doesn't match the saved legitimate URL.
The phishing kit relayed captured credentials instantly, via a Telegram channel, to the attacker, who logged into the real portal and triggered a genuine one-time code; the fake page then re-prompted the victim for that code, relayed it in turn, and the attacker used it before expiry, defeating SMS and TOTP-based MFA.
Deploy phishing-resistant MFA (FIDO2/WebAuthn hardware security keys with origin binding) instead of SMS or TOTP codes. Cloudflare showed this is the one control that stops this exact relay technique even after credentials are already phished.
In some flows, once a victim had submitted both credentials and MFA code, the phishing page pushed the AnyDesk remote-access tool, which would have given attackers direct control of the victim's machine had it been installed; Cloudflare's Cloudforce One team documented this fallback step.
Enforce endpoint controls and application allowlisting that block installation of unsanctioned remote-access software such as AnyDesk.
With valid sessions or credentials, attackers reached internal and customer-support systems (as at Twilio and Mailchimp), harvested customer data, and used that vendor-side access to attempt account takeovers at the vendors' own customers, such as re-registration attempts on Signal accounts and password-reset attempts on DigitalOcean accounts, completing the objective of broad, monetizable access across a supply chain.
Apply least-privilege access to customer-support tooling, monitor for anomalous internal system access, and rotate credentials and terminate sessions immediately on suspected compromise, so a vendor breach cannot silently cascade into its customers' accounts.
Browse by what this case has in common with others in the library.
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
Fake Anti-Scam Centre and police officers convinced a Singapore finance worker she was a suspect, then took S$1.2M through transfers…
FraudGPT was sold at $200 a month as an unrestricted AI for phishing. When Cisco Talos tried to buy it,…
Two New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen…
Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam…
A convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a…
Imperva hid prompt injections behind whitespace in contact names, vCards and WhatsApp pins, making an OpenClaw agent run a script.…
A forged "change your remittance bank account" email tricked a Puerto Rico government corporation into wiring $2.6M to a fraudster-controlled…
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole…
The FTC's first-ever case under the FACTA Disposal Rule: a Northbrook, Illinois mortgage lender repeatedly dumped intact customer credit reports.
In 2025 the FBI, FTC and USPIS warned of unordered packages with QR codes that lead to phishing sites or…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A Kansas City TV station found intact consumer home-loan applications with Social Security and account numbers tossed in a title…
In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX…
Fraudsters swapped a former MP's number in his company's phone but kept his photo, then ordered Rs 7.68 crore in…
Fake Anti-Scam Centre and police officers convinced a Singapore finance worker she was a suspect, then took S$1.2M through transfers…
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
Fraudsters posing as RBS fraud-team staff talked Hamilton Academical FC's sole authorised banking employee into moving nearly £1 million into…
SABRIC recorded R2.4bn in South African digital banking fraud claims in 2025, driven by phishing, fake bank calls and SIM…
Social Engineering Examples