Skip to content
attack.paths
Anmelden
← RegistryDossier · 6 steps · 5 edges

Mass SMS phish → Okta-style portal → SaaS sprawl (0ktapus)

Wide SMS phishing campaign targeting employees of ~130 organisations with a single phishlet that captures Okta credentials + push approval. Mass automated logins to Twilio, MailChimp, DoorDash et al.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: many tenants use Okta-style SSO with push MFA. SMS bypasses email phishing filters. Phishlet captures credentials + relays push approval in real time.

§ Steps

  1. 01
    Cross-app data harvestExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Sweep every SSO-connected SaaS appInitial Access
    T1078— Valid Accounts
  3. 03
    Buy / scrape employee phone numbersReconnaissance
    W-RECON-GITHUB-DORK— GitHub / GitLab Dorking
  4. 04
    Capture creds + push approvalInitial Access
    PH-AITM-EVILGINX— AITM Phishing — Evilginx / Modlishka
  5. 05
    Stand up phishlet (Okta clone)Resource Development
    T1583— Acquire Infrastructure
  6. 06
    Mass SMS to victims with phishlet URLInitial Access
    APT-OKTASS-0KTAPUS— 0ktapus SMS-Phish Sweep

§ References

§ Frequently asked

What is the "Mass SMS phish → Okta-style portal → SaaS sprawl (0ktapus)" attack path?
Wide SMS phishing campaign targeting employees of ~130 organisations with a single phishlet that captures Okta credentials + push approval. Mass automated logins to Twilio, MailChimp, DoorDash et al. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Cross-app data harvest (T1041) — a exfiltration primitive. Assumed environment: many tenants use Okta-style SSO with push MFA.
What is the final impact of this kill-chain?
The final step lands on Mass SMS to victims with phishlet URL (APT-OKTASS-0KTAPUS), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers