Phishing kits adapt to the script of callers

Okta Threat Intelligence describes custom phishing kits used in vishing campaigns that let attackers on a call control a target’s browser authentication flow to capture credentials and coerce or bypass MFA; these kits are offered as-a-service, target Google, Microsoft, Okta and cryptocurrency providers, and are effective at defeating MFA that is not phishing-resistant.