Hackers use Twilio’s access to steal OTPs from Okta customers

The attackers behind the Twilio breach were able to use their access to steal one-time passwords sent via text message to customers of identity and access management company Okta.

At the time of the break-in, Twilio was providing one of the services that Olta offered to customers who chose SMS as a form of verification.

According to Okta, on August 8, the company learned that the Twilio hack revealed “unspecified data relevant to Okta” and started to route SMS-based communications through a different provider. After analyzing an internal system log from Twilio’s security team, Okta discovered that the threat actor had access to phone numbers and codes belonging to its customers.

Okta’s investigation revealed that the intruder did not use these mobile numbers, and the company has linked the attack to Scatter Swine, a phishing campaign that targets logins to gain access to corporate networks.

To mitigate Oktapus attacks, Okta advises users to pay more attention to suspicious emails and phishing sites, and to use Network Zones to deny or perform step-up authentication on requests from rarely used networks.

Other steps users can take include restricting access to applications to only registered devices or devices managed by endpoint management tools and restricting access to the most sensitive applications and data using application-specific authentication policies.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web