Trending Articles
Trending Topics
Trending
Social engineering campaigns evolve like any other form of attack, but sometimes the threat creeps up on you. Then bam: suddenly you realise it’s a whole other level of risk to your organisation. Such is the case with what LevelBlue security researchers are calling Okta Vishing.
“This shift is redefining initial access, turning what was once an account compromise into an immediate data breach scenario,” said Jamie Mamroe, an Incident Responder at Cybereason, which was acquired by LevelBlue in November last year.
The shift Mamroe refers to is one that has seen attackers move away from phishing emails that target the inbox and towards voice calls impersonating IT support or an employee. But with one clear goal: compromising Single Sign-On.
“In many cases,” Momroe warned, “this quickly leads to SharePoint and OneDrive data exfiltration, making this far more than just an authentication event.’
If that sounds kind of scary, it should do, as it is. We are no longer talking about a single account compromise, but rather a potential full and immediate, organisation‑wide, cloud data breach.
The LevelBlue report revealed that the Okta vishing attackers attempt to get the victim to:
And all while literally walking the target through the process over the phone.
“The initial attack vector here is still classic social engineering, however, the strategy has matured,” said Mika Aalto, Co-Founder and CEO at Hoxhunt.
“The playbook resembles groups like Lapsus$, Scattered Spider, and ShinyHunters, who used voice phishing to pressure help desks into resetting credentials or enrolling new authentication devices in breaches tied to platforms like Salesforce and Snowflake.”
The potential payload, Aalto concedes, makes these Okta vishing attacks both more efficient and significantly more damaging than traditional phishing campaigns.
“Defending against these campaigns requires moving beyond awareness training to robust identity verification,” said Jason Soroko, Senior Fellow at Sectigo. “Mandatory video verification and certificate-based authentication” should also be considered, he added.
Meanwhile, Okta has published a detailed threat advisory for customers regarding such attackers. “In a workplace context, there is no substitute for enforcing phishing resistance for access to resources,” said Moussa Diallo, Threat Researcher at Okta Threat Intelligence. He added: “When using Okta for workforce authentication, that would equate to enrolling users in Okta FastPass, passkeys or both for the sake of redundancy.”
