0ktapus / Twilio - SMS Phishing at Scale → Credentials and Live OTPs Relayed → 130+ Organizations Breached → And the One That Held
In August 2022 a campaign Group-IB named 0ktapus sent SMS messages to employees at scores of companies, impersonating internal IT and pointing at convincing Okta login pages. It worked repeatedly: roughly 9,931 accounts across more than 130 organizations, Twilio among them, and Twilio's compromise then reached downstream customers including Signal. This chain is on the site for a reason none of the others are. Cloudflare received the same messages, on the same day, from the same actor, and at least three employees entered their credentials and their one-time codes into the phishing page. The attack still failed - because Cloudflare required FIDO2 hardware security keys, and a hardware key will not authenticate to a domain it was not registered to, no matter how convincing the page or how cooperative the human. Every other kill chain here ends in a control that was missing, bypassed, or absent. This one ends in a control that simply worked.
SMS was chosen deliberately. It arrives on a phone rather than in a mail client with a decade of filtering behind it, it carries no sender reputation a user can check, and a shortened link looks normal there in a way it would not in email. The registered domains combined the target company's name with terms like -okta or -sso, and the pages they served were faithful copies of the real Okta login. Group-IB's analysis found the phishing kit had been used against a large list of organizations, with the target's own branding applied per victim. Nothing here is technically advanced. The sophistication is in the industrialization: one kit, many companies, all hitting at once.
Pretext: Expired password, or a schedule change requiring sign-in
Domains: Company name combined with
-okta / -sso patternsPage: A faithful copy of the organization's real Okta login
Why SMS: No mail filtering, no sender reputation, short links look normal
This is the step that matters, and it is why "we have MFA" is not the end of the sentence. A time-based one-time code is a shared secret with a short life, so an attacker standing between the victim and the real site can simply forward it inside its validity window. The victim sees a login that appears to succeed. The attacker holds a real session. Every phishable factor fails the same way here - SMS codes, authenticator app codes, and push approvals, because all of them are things the user can be induced to hand over or approve. The 0ktapus kit reportedly relayed to a Telegram channel so operators could act on codes immediately, which is what makes the technique scale past one careful attacker.
Mechanism: Real-time relay to the genuine login inside the code's validity window
Victim experience: A login that appears to work
Factors defeated: SMS codes, TOTP app codes, push approval - anything the user can pass on
Scale enabler: Captured credentials relayed to operators in real time
Group-IB's investigation put the campaign at more than 130 organizations and close to ten thousand accounts, heavily concentrated in companies using Okta - hence the name. Twilio's compromise is the one with the longest tail, because Twilio provides SMS and authentication infrastructure to other companies: the actor reached data for a number of customer accounts, and through that, phone numbers and SMS verification codes for roughly 1,900 Signal users. That is an identity provider chain running two levels deep, and it prefigures exactly what the Okta support system breach would do a year later. Twilio also later disclosed a second, earlier intrusion by the same actor in June 2022, found during the follow-up investigation.
Twilio: Customer account data reached
Downstream: ~1,900 Signal users - phone numbers and SMS verification codes
Also found: An earlier June 2022 intrusion by the same actor, discovered afterwards
Structure: An authentication provider compromised, then its customers
Cloudflare's published account is unusually useful because it does not claim its people were smarter. They were phished, they fell for it, and they typed their credentials into the attacker's page. What stopped the intrusion was that the attacker then could not complete the login: a FIDO2 security key performs a cryptographic challenge scoped to the origin it was registered against, so a key enrolled for cloudflareokta.com's real domain will not respond to a request from a lookalike. There is no code for the user to read out, nothing to approve, and nothing to relay. The human failure was total and the technical control absorbed it completely. That is what a good control looks like - one that does not require the person to be having a good day. Cloudflare also noted the hardware keys were mandatory and issued to every employee, which matters because a control with exceptions is a control with a way in.
Why it failed: FIDO2 keys perform an origin-bound cryptographic challenge
Nothing to relay: No code is displayed, nothing is approved by the user
Coverage: Hardware keys mandatory and issued to all employees, with no exceptions
The point: The control did not depend on anyone spotting the phish
🛡 How to Defend Against This Chain
-okta or -sso. Certificate transparency monitoring and domain registration feeds surface these within hours of registration, which is usually before the first message is sent. This is cheap and it buys you the initiative.