Uber 2022 Breach: MFA Push-Bombing and IT-Support Impersonation of a Contractor

What Happened

On September 15, 2022, an attacker gained access to Uber's internal systems and announced the intrusion by posting to a company-wide Slack channel and reconfiguring Uber's OpenDNS to show a graphic image on some internal sites. Employees initially thought the Slack message was a joke. Uber took down internal tools as a precaution and notified law enforcement.

In its September 19 security update (also filed with the SEC as Exhibit 99.1 to a Form 8-K), Uber said an "EXT" contractor's account had been compromised. Uber assessed that the attacker likely purchased the contractor's Uber corporate password on the dark web after the contractor's personal device was infected with information-stealing malware. The attacker repeatedly attempted to log in, and each attempt triggered a two-factor approval request, which the contractor initially declined.

Eventually the contractor approved one, and the attacker got in. Security-vendor and researcher analysis (Group-IB, and a researcher who communicated with the attacker) added that the attacker also contacted the contractor via WhatsApp posing as Uber IT support, telling them the push notifications would only stop if they approved one.

Once on the network via VPN, the attacker moved laterally and found an internal network share containing PowerShell scripts, one of which held hard-coded admin credentials for Uber's privileged access management (PAM) system (Thycotic). Using those, the attacker reached numerous internal tools and services, including G-Suite/Google Workspace, Slack, AWS, and the HackerOne bug-bounty dashboard.

Uber reported it found no evidence the attacker reached production systems, user accounts, or the databases holding sensitive customer data (credit card numbers, bank details, trip history), and no evidence of codebase changes. The attacker did download some internal Slack messages and information from a finance tool used to manage invoices, and accessed HackerOne vulnerability reports, which Uber said were remediated.

A UK jury found Arion Kurtaj committed the acts in August 2023, and in December 2023 he was sentenced to an indefinite hospital order after being assessed unfit to stand trial.

How the Attack Worked

Kill chain at an awareness altitude: (1) Recon/credential sourcing: the contractor's personal device was infected with infostealer malware, and the resulting corporate credentials were sold on a dark-web marketplace, giving the attacker a valid username and password without any technical exploit. (2) Contact/exploitation of MFA: possessing the password but blocked by push-based MFA, the attacker repeatedly triggered login attempts so the contractor's phone was flooded with approval prompts. (3) Rapport/pretext: the attacker reached the contractor out-of-band on WhatsApp, impersonating Uber IT and framing approval as the fix for the annoying prompts. (4) Approval/access: worn down and misled, the contractor approved a prompt, handing the attacker VPN access. (5) Escalation: inside a flat internal network, the attacker found hard-coded admin credentials in a script and pivoted into the PAM system and many connected tools.

The human failure point was a single MFA approval induced by fatigue plus authority, and the technical failure points were phishable push MFA (no number-matching), broad contractor network reach, and a hard-coded privileged credential.

The Lure & the Tell

Pretext: an "IT support" message (via WhatsApp) claiming a login bug and telling the target that approving the MFA push was the only way to stop the barrage of notifications. Red flags a defender should notice: a flood of unexpected MFA prompts (you should never approve a request you did not initiate), "IT support" reaching out over an unofficial channel like WhatsApp rather than a verified internal system, urgency and the promise that approving will "make it stop," and any request whose real effect is to grant a login you cannot account for.

Outcome

Attacker gained broad access to Uber's internal tooling and publicly defaced internal channels; Uber disabled tools, reset credentials, rotated keys, locked its codebase, and re-authenticated staff. No evidence of access to production systems or sensitive customer data. Uber strengthened its MFA policies. UK prosecutors put damage to Uber at nearly $3M; Arion Kurtaj was found by a jury to have committed the acts (Aug 2023) and sentenced to indefinite hospital detention (Dec 2023).

Why It Matters

This is a textbook demonstration that MFA is not a silver bullet: push-approval MFA can be defeated by simply exhausting and then deceiving the human on the other end. It shows how commodity infostealer malware plus dark-web credential markets remove the need for any exploit, and how one over-privileged contractor account plus a hard-coded secret can cascade into enterprise-wide compromise.

It is a canonical case for training people to reject unexpected MFA prompts and distrust out-of-band "IT support" contact.

Defenses

Phishing-resistant MFA (FIDO2/WebAuthn hardware keys or passkeys) instead of simple push approvals; number-matching and rate-limiting/lockout on repeated push prompts; user training to deny and report unrequested MFA requests and to verify any "IT support" contact through official channels only. Technical controls: eliminate hard-coded/service-account credentials in scripts, enforce MFA on PAM console access, network micro-segmentation to limit contractor VPN reach, least privilege for third parties, and anomaly detection for repeated denied auth attempts.