how it happened
- who0ktapusSMS phishing
- the gapemployee credentialstyped into the fake page
- the result209 customers130+ companies targeted
what everyone assumed
Phishing awareness focuses on email, so SMS feels like a lesser channel and a trained workforce feels like sufficient defense. The assumption is that people who know not to click a suspicious email also know not to type their password into a texted link.
what happened
Enough employees entered their credentials into the cloned page to give the attacker working logins. The same campaign ran the same playbook against more than a hundred other companies in parallel, harvesting credentials one convincing text at a time.
step by step
- employees get texts pointing to a cloned login page
- enough of them enter credentialsThe attacker gets working logins.the assumption breaks here
- August 2022209 customers and 93 Authy users affectedPart of 0ktapus, which hit 130 plus organisations.
how it surfaced
In August 2022 Twilio disclosed the breach: 209 customers and 93 Authy end users affected, part of the 0ktapus campaign that struck 130-plus organizations through SMS phishing.
A trained workforce reduces clicks; it never zeroes them, and an attacker only needs one.
The durable defense is a credential a cloned page cannot capture, not a workforce that never makes a mistake.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA few people enter their details, and the attacker is in.what it costs youCustomer data is reached, and the same trick hits dozens of companies that week.
- or it goes like thisit happenedReddit, 2023howA fake login page passes the password and code to the real site as they are typed.what leavesinternal documents, code and dashboardswho ends up with itthe attacker behind the page
- or it goes like thisit happenedUber, 2022howLogin prompts keep coming until a tired employee taps approve.what leavesadmin tools and company chatwho ends up with itan attacker who bought a contractor's password
sources
your turn
what you can do about it
this week
Check whether your staff's second factor can be relayed through a fake login page.
Your MFA, if it is a code or a prompt, can be relayed through exactly the kind of cloned page that caught Twilio. Phishing-resistant factors cannot. Which kind your staff use is the question this incident asks, and it is answerable today.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →