0ktapus Phishing Snags 10,000 Credentials Across 130 Companies—Your MFA Is the Weak Link
Your next SMS from 'IT support' could hand hackers your company's keys. 0ktapus just proved MFA is no silver bullet, snaring thousands in a slick Okta phishing blitz.
⚡ Key Takeaways
- 0ktapus phished 9,931 Okta-linked accounts across 130+ orgs via SMS MFA bypass.
- Started with telecoms for phone numbers, scaled to supply-chain attacks.
- SMS and push MFA are phishable; switch to hardware keys now.
🧠 What's your take on this?
Cast your vote and see what Threat Digest readers think
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by Threatpost
Related Stories
Security Tools
Casbaneiro Gang's Sneaky Dynamic PDFs Hit Enterprises in LatAm and Europe
Ransomware & Malware
Claude Code's 50-Command Cap: The Bypass That Unlocks Your Dev Machine
Ransomware & Malware
REF1695's ISO Trick: $9K Crypto Haul from Fake Installers and RATs
Ransomware & Malware