Phishing kits adapt to the script of callers

Okta Threat Intelligence has identified and analyzed custom phishing kits used in vishing campaigns that let callers control the victim's browser authentication flow to harvest credentials and prompt users to approve MFA or take other actions. These kits, offered as-a-service and in active use against Google, Microsoft, Okta, and cryptocurrency providers, synchronize page presentation with caller scripts to defeat MFA mechanisms that are not phishing-resistant.