Retool breach (2023): a fake IT text, a phone call and synced MFA codes

In August 2023, attackers sent Retool employees a text posing as IT, about a payroll sync for open enrolment, with a link to a fake Okta login. One employee entered a password and a one-time code. Then the attacker phoned them, posing as IT again, and got a second code. That let the attacker add their own device, and because the employee's Google Authenticator synced to the cloud, one account opened many others. The attacker took over 27 crypto customers' accounts. Status: Documented incident; deepfake claim unverified.

The text and the call

Several employees got a text from "IT" saying their payroll system was out of sync and needed fixing for open enrolment. The link looked like Retool's own login: retool.okta.com followed by more text. But the real domain was oauthv2.app. Everything before it was just words the attacker chose.

Nearly everyone ignored it. One person logged in on the fake page and entered a password and a one-time code. The attacker then called that person, posing as IT. Retool says the caller knew the office floor plan, colleagues and internal processes. The employee grew more suspicious as the call went on, but still gave one more code.

Tip: read a link from right to left. The real domain is the last part before the first single slash. Anything to its left can say whatever the attacker wants.

How one code became 27 accounts

Retool told the 27 customers on 29 August, closed all internal sessions and restored the hijacked accounts. Customers running Retool on their own servers weren't affected.

The deepfake claim

Retool's write-up says the caller "deepfaked our employee's actual voice". That's the only evidence. Retool released no audio and no forensic finding, and its head of engineering declined to explain further when Ars Technica asked. Ars called it "a separate and completely unverified claim" and suggested it might distract from Retool's own role. The insider knowledge, which nobody disputes, is enough on its own to explain a convincing call.

The money

Retool never said money was stolen or named its customers. The loss comes from the customer side. Fortress Trust, a Nevada trust company, said four of its customers were hit through a breached cloud vendor. It first said there was "no loss of funds". Five days later its chief executive told Fortune the loss was $12 million to $15 million in crypto, mostly Bitcoin. CoinDesk identified the vendor as Retool. Neither company has confirmed the link on the record.

Fortress said it repaid most affected clients from its own funds within 48 hours, and Ripple covered one larger client.

What would have stopped it

• Phishing-resistant MFA, like hardware keys, which can't be read out over the phone.
• Turn off cloud sync for authenticator apps on work accounts, or use a separate app.
• IT never asks for codes. Make that a rule everyone knows.
• Verify callers by hanging up and calling IT back on a known number.
• Alert on new devices added to identity accounts.

See also 0ktapus, a similar Okta-themed smishing campaign, and account takeover.

Common questions