0ktapus 2022: text-message phishing that collected Okta logins and codes at Twilio, and why Cloudflare's security keys held

In the summer of 2022 one group sent the same kind of text message to staff at more than 130 companies: your password has expired, or your schedule has changed, sign in here. The link opened a copy of the company's Okta sign-in page. Group-IB, which named the campaign 0ktapus, counted 9,931 usernames and passwords and 5,441 one-time codes collected that way.

Two of the targets wrote public reports within weeks of each other, and they make a rare side by side. At Twilio, staff typed their password and code into the fake page; the attacker got into internal tools and then into data of 209 customers. At Cloudflare, three staff typed their password too, and nothing happened: the second factor there was a hardware security key, and a key will not sign in to a domain it wasn't registered for. Same lure, same summer, different factor. This is how it worked step by step, and the cheap way a small team gets the Cloudflare result.

Step 1: a domain under an hour old

Cloudflare's timeline shows how little preparation the lure needed. The domain cloudflare-okta.com was registered through Porkbun at 22:13 UTC on 20 July 2022. Thirty-six minutes later, at 22:49, the texts went out: at least 76 employees got one within a minute, on work and personal phones, and some family members too. They came from four T-Mobile numbers, so nothing about the sender looked like a company.

Group-IB found 169 domains across the campaign, built from the target's name plus words like sso, vpn, okta, mfa or help. Most targets were IT, software and cloud companies in the US, plus finance and crypto firms. How the attackers got so many staff phone numbers was never fully explained; Cloudflare checked its own directory logs and found no sign they came from there.

Step 2: a copy of the Okta page that relays everything

The page asked for a username and password, then for the code from the authenticator app or SMS. It sent each value to the attackers through a Telegram bot as soon as it was entered. The page itself was static, so the attacker had to be awake and fast: an authenticator code lives for about 30 seconds, an SMS code a few minutes. Signing in to the real Okta with a fresh code is easy in that window.

At the end, the page started a download of AnyDesk, a legitimate remote-access tool. Anyone who installed it would have given the attacker a second way in that doesn't care about passwords at all.

Step 3: at Twilio, the code worked

Twilio's staff, current and former, got hundreds of these texts in July. Some signed in on the fake page. With a password and a fresh code the attacker was signed in as those employees, and their access reached Twilio's internal admin tools.

• 4 August: Twilio saw the unauthorized access. The last activity it observed was on 9 August.
• Customers: the first count was 163; the final report (27 October 2022) said 209 of more than 270,000 customer accounts had data accessed, plus 93 Authy users. Twilio found no sign that customers' console passwords, auth tokens or API keys were taken.
• Earlier: a voice-phishing call on 29 June had already given someone a view of some customer contact details. Twilio's report covers both incidents and says they used similar tactics.

Step 4: Twilio's customers became the next targets

Twilio sends text messages for other companies, including sign-in codes. With access to its console, the attacker could read those messages.

• Signal uses Twilio for phone-number verification. About 1,900 Signal users' numbers and SMS registration codes could have been seen. Signal said the attacker searched for three numbers explicitly, and one of those users reported that their account had been re-registered.
• Okta found that the attacker had searched for 38 phone numbers in the Twilio console, nearly all at one Okta customer: they used passwords phished earlier to trigger SMS codes, then read the codes in the console. A stolen password plus a code read at the SMS provider is a valid sign-in.
• Group-IB lists other companies breached in the same campaign, including Mailchimp and Klaviyo, where crypto-related customers were the prize.

That chain is the part worth remembering: a factor sent by SMS is only as strong as every company the message passes through.

Step 5: at Cloudflare, the key said no

Cloudflare doesn't use authenticator codes. Every employee has a FIDO2 security key (a YubiKey or similar), and the company's sign-in asks for it. Three employees entered their password on the fake page. When the attacker tried those passwords on the real sign-in, it stopped at the key.

Why the key didn't work for the attacker:

1. The browser tells the key which site is asking: cloudflare-okta.com, not the real sign-in domain.
2. The key holds a credential only for the real domain, so it has nothing to sign for the fake one. The employee never gets a code to copy, because there is no code.
3. The attacker can't relay a signature that was never made. The password alone fails.

Cloudflare's response took a little over an hour, by its own timeline: the domain blocked on company devices at 22:52, a warning to all staff at 22:58, the page taken down by the hosting provider at 23:26, the three employees' passwords and sessions reset at 23:37. Nobody reached the AnyDesk step. The three who typed their password "were not reprimanded", Cloudflare wrote: "having a paranoid but blame-free culture is critical for security."

Why this keeps working

• A code is just text. Authenticator codes, SMS codes and email codes can all be typed into the wrong page and relayed. They stop password reuse; they don't stop a live phishing page. The Tycoon2FA kit does the same relay at scale for Microsoft 365 and Gmail.
• Text messages arrive outside the mail filter. No link scanner, no external-sender banner, and a phone screen that hides most of the address.
• A new domain looks like any other. Nothing in a browser warns that a domain was registered an hour ago.
• Push approvals aren't the answer either. They can be relayed or simply pressed too often, as Uber found in 2022.

The cheap way a small team gets the Cloudflare result

You don't need Okta or a security team. Google Workspace, Microsoft 365, GitHub, AWS and most password managers already accept passkeys and security keys.

1. Start with the accounts that can change everything: domain registrar, DNS, email admin, cloud console, code host, password manager, payment provider. Turn on passkeys or security keys there first.
2. Two keys per person, one carried, one kept safe. FIDO-only keys cost around $25 to $30 each. A passkey on a phone or laptop is free and is bound to the site the same way.
3. Remove the codes once the keys work. If SMS or an authenticator app is still allowed as a fallback, the phishing page simply asks for that. In Google Workspace that is the security-key-only option under 2-Step Verification for admins; in Microsoft 365 it is an authentication strength that requires phishing-resistant MFA.
4. Write down the recovery steps before someone loses a key: who can reset it, and how they check who's asking. A help desk that resets a factor on a phone call undoes all of this; it's how MGM was entered in 2023.
5. Ask staff to report texts like these, and thank them when they do. Cloudflare's first reports came within a minute, which is why the block arrived before most people had clicked.
6. Block remote-access tools you don't use, so a download like AnyDesk can't run on company machines.

If you also run a site with a sign-in, the same thinking applies to your users. Count failed codes and new devices per account, not only per IP: osec Login Protection does that for a sign-in form without moving your DNS.

Sources: Cloudflare: The mechanics of a sophisticated phishing scam and how we stopped it; Group-IB: Roasting 0ktapus; Twilio: Incident report, August 2022 social engineering attack; Okta: Detecting Scatter Swine; Help Net Security: 1,900 Signal users exposed following Twilio breach; Krebs on Security: Feds charge five men in Scattered Spider roundup. In November 2024 US prosecutors charged five men over SMS phishing between September 2021 and April 2023 against employees of at least 12 companies; Krebs reports the victims included Twilio, LastPass, Mailchimp and Okta.