New “Phishing-as-a-Service” Platforms Enable Attackers to Steal Okta SSO Credentials
Okta has issued a warning about a new class of phishing platforms built specifically for voice-based social engineering attacks. These tools, now being actively used in campaigns, allow threat actors to steal single sign-on (SSO) credentials by manipulating victims during phone calls.
Functioning as live adversary-in-the-middle systems, these platforms allow attackers to dynamically change what a victim sees in their browser while guiding them over the phone, creating a synchronized and highly convincing authentication flow.
The phishing kits are sold under a “phishing-as-a-service” model and are being used by multiple hacking groups targeting identity providers such as Okta, Google, and Microsoft, as well as cryptocurrency and financial platforms.
How the Attacks Work
The attacks begin with reconnaissance. Threat actors research employees at targeted organizations, identifying which applications they use and which phone numbers are associated with internal IT or helpdesk teams.
They then call victims using spoofed corporate numbers and impersonate IT staff. Victims are directed to custom phishing websites branded to look like internal company portals, often using names that include terms like “internal” or “my.”
As credentials are entered into the phishing site, they are forwarded to the attacker’s backend. The attacker simultaneously attempts to log in to the real service. When an MFA challenge appears, the phishing platform updates instantly to mirror the prompt, allowing the attacker to guide the victim through approving the request or entering TOTP codes.
Because the attacker controls both the call and the phishing interface, even push-based MFA with number matching can be bypassed.
From SSO to Data Theft
Once an account is compromised, attackers log into the victim’s Okta SSO dashboard to see which business platforms they can access. This often includes cloud storage, CRM systems, collaboration tools, and development environments.
From there, attackers focus on extracting sensitive data, with platforms like Salesforce being common targets due to how easily large volumes of data can be exported. In many cases, stolen data is followed by rapid extortion attempts, with demands to prevent public disclosure.
Because platforms like Okta act as a gateway to an organization’s cloud ecosystem, compromising a single SSO account can effectively compromise the business itself. Sources indicate that these campaigns are currently active across fintech, wealth management, and financial advisory firms, and some extortion messages have been linked to known breach groups such as ShinyHunters.
What Organizations Should Do
Okta recommends customers adopt phishing-resistant authentication methods such as FIDO2 security keys, passkeys, and Okta FastPass. These approaches eliminate shared secrets and cannot be intercepted or replayed by adversary-in-the-middle attacks.
More broadly, this campaign shows that social engineering is becoming more technical, more interactive, and more effective. Defending against these threats necessitates more than traditional MFA and security awareness training. It requires strong identity controls and continuous monitoring of authentication activity.
Organizations should also invest in sophisticated social engineering assessments that replicate emerging attack strategies, including live vishing scenarios and adversary-in-the-middle techniques. Testing these scenarios on a regular but not overwhelming cadence, such as quarterly, helps maintain employee awareness without causing training fatigue, while giving security teams insight into how their defenses perform under pressure.
Jeff Moore
Elizabeth Di Bene
JoJo D
Aby Rao