The attackers behind the Twilio breach were able to use their access to steal one-time passwords sent via text message to customers of identity and access management company Okta.
At the time of the break-in, Twilio was providing one of the services that Okta offered to customers who chose SMS as a form of verification.
According to Okta, on August 8, the company learned that the Twilio hack revealed “unspecified data relevant to Okta” and started to route SMS-based communications through a different provider. After analyzing an internal system log from Twilio’s security team, Okta discovered that the threat actor had access to phone numbers and codes belonging to its customers.
Okta’s investigation revealed that the intruder did not use these mobile numbers, and the company has linked the attack to Scatter Swine, a phishing campaign that targets logins to gain access to corporate networks.
To mitigate Oktapus attacks, Okta advises users to pay more attention to suspicious emails and phishing sites, and to use Network Zones to deny or perform step-up authentication on requests from rarely used networks.
Other steps users can take include restricting access to applications to only registered devices or devices managed by endpoint management tools and restricting access to the most sensitive applications and data using application-specific authentication policies.
The sources for this piece include an article in BleepingComputer.